Re:SSHD: Random boot time relinking, OpenBSD
by jcalvinowens on Saturday January 21, 2023 @12:07PM
(#34467867)
The traditional antidote to ASLR is "known code reuse", tricks like ret2libc, ret2plt, etc.
FG-ASLR helps a lot because there are now N possible randomized locations for the piece of code your exploit leverages, so if you pick one and exploit M machines that way, only M/N of the exploits will succeed (where you got lucky).
Ultimately it is obfuscation, but with enough entropy it is very effective. It can't mitigate or prevent an exploit, but it makes it a lot more work to turn an exploit into code execution consistently enough for it to be useful.
FG-ASLR helps a lot because there are now N possible randomized locations for the piece of code your exploit leverages, so if you pick one and exploit M machines that way, only M/N of the exploits will succeed (where you got lucky).
Ultimately it is obfuscation, but with enough entropy it is very effective. It can't mitigate or prevent an exploit, but it makes it a lot more work to turn an exploit into code execution consistently enough for it to be useful.