Address-Space Layout Randomization (ASLR) is a defensive technique which randomizes the memory address of software, deterring exploits that rely on knowing the location of applications memory map. Moving from 32 to 64-bit architectures does not only increase the number of random bits available: the application binary interface (ABI) changes too, which rules out classic techniques and makes bypassing the ASLR on x86_64 substantially harder.
return-to-csu is a generic method to bypass the ASLR on 64-bit GNU/Linux systems. Unlike other approaches, it does not rely on the code compiled from the target application but on code that the linker silently attaches to every dynamically compiled executable. In practice, this means the method can be applied to virtually any application.
The method is generic, since it does not use the compiled code from the target application but code that is always «silently attached» to it. This, in practice, means that our attack can be applied to any application. We present our analysis, which reveals who is attaching this «extra code» to the executable memory and why this code can not be easily protected or removed by application developers.
Although the idea of incremental compilation to do less work sounds generally good, it could raise some security issues. Having code which is not re-compiled could result in old or less protected code that can be abused by attackers.
Finally, we discuss the root cause and provide some recommendations to prevent the return-to-csu attack. The full analysis, the proof of concept and the proposed countermeasures are described in the white paper and the slides presented at Black Hat Asia 2018.
After the presentation, the issue was reported to the GNU C Library as BZ #23323 («CSU startup code hardening», June 2018) and fixed in glibc 2.34 (August 2021) by Florian Weimer, commit 035c012e «Reduce the statically linked startup code [BZ #23323]» (mirror), which cites this work in its commit message.
The patch removes csu/elf-init.c from dynamically linked binaries: those functions are not needed there, since DT_INIT and DT_INIT_ARRAY are already processed by the dynamic linker. A new symbol version, __libc_start_main@@GLIBC_2.34, was introduced so that binaries built against the new library do not silently skip their constructors when run on an older one.
Two caveats remain. The change has ABI implications, so it was not backported to earlier releases, and statically linked binaries still use the previous startup code. Systems running older libraries, and static binaries on any version, are therefore still affected.
This work continues the line started with the Offset2lib attack (DeepSec 2014) and the ASLR-NG design, which addresses the weaknesses of the current ASLR implementations.
