I am using Ubuntu 12.04 32-bits now for some experiment I need to disable ASLR how can I do this? and after that what should I do to enable ASLR again?
-
1For self only: stackoverflow.com/questions/11238457/… || unix.stackexchange.com/questions/15881/… – Ciro Santilli 郝海东冠状病六四事件法轮功 Jul 28 '15 at 13:28
According to an article How Effective is ASLR on Linux Systems?, you can configure ASLR in Linux using the /proc/sys/kernel/randomize_va_space interface.
The following values are supported:
- 0 – No randomization. Everything is static.
- 1 – Conservative randomization. Shared libraries, stack,
mmap(), VDSO and heap are randomized.- 2 – Full randomization. In addition to elements listed in the previous point, memory managed through
brk()is also randomized.
So, to disable it, run
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
and to enable it again, run
echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
This won't survive a reboot, so you'll have to configure this in sysctl. Add a file /etc/sysctl.d/01-disable-aslr.conf containing:
kernel.randomize_va_space = 0
should permanently disable this.
answered Jul 10 '13 at 11:17
-
1What exactly is "Full randomization"? Does that include the executable itself? And what is
brk()? – Shuzheng Feb 15 '19 at 16:13 -
@Shuzheng
brk()is the break address during memory allocation stackoverflow.com/questions/6988487/… – Niklas R. May 20 at 17:42 -
@Niklas - Does any of the above levels include the executable core itself? – Shuzheng May 20 at 17:55
-
@Shuzheng I think so, meaning that I needed to turn it off in order to succeed in provoking a buffer overflow. If ASLR is enabled then an attacker cannot easily calculate memory addresses of the running process even if he can inject and hijack the program flow. At level 1, if I understand it correctly, both the absolute and relative addresses of the process will be randomized and at level 2 also dynamic memory addresses will be randomized. There are example programs you can experiment with in a VM or container where you disable the ASLR and try to hijack the process (search for overflow) – Niklas R. May 20 at 18:04
-
@Shuzheng If you mean that ASLR can be disabled and enabled for the Linux Kernel itself, then that is more than I know... but surely it will be in the manual somewhere about this – Niklas R. May 20 at 18:05
The /proc/sys/kernel/randomize_va_space interface controls ASLR system-wide.
If you don't want a system-wide change, use ADDR_NO_RANDOMIZE personality flag to temporarily disable ASLR. Controlling of this flag can be done with setarch and its -R option, like
setarch `uname -m` -R /bin/bash
This will open a new Bash shell for you with ASLR disabled, including all child processes run from this shell. Just exit the shell once you're done.
By the way, on i386, ulimit -s unlimited can effectively "disable" ASLR.
EDIT (Apr 2016): The ulimit -s unlimited was fixed and assigned CVE-2016-3672.
The more permanent ways of disabling ASLR should be kept in a VM for obvious reasons.
to test the ability to overwrite stack frame return addresses etcetera, you'll need to compile without stack canaries -fno-stack-protector, while to allow you to execute code on the stack you need to compile with -z execstack, making
$ gcc -fno-stack-protector -z execstack -o <my_program> my_code.c
You can use the following command to temporarily disable ASLR.
sudo sysctl kernel.randomize_va_space=0
