Messages in this thread | | | Date | Fri, 27 May 2011 19:00:45 +0200 | From | Ingo Molnar <> | Subject | Re: [RFC][PATCH] Randomize kernel base address on boot |
| |
* Linus Torvalds <torvalds@linux-foundation.org> wrote:
> If you compile your own kernel version, you're already home free, > and load-time randomization is pointless.
Most successful exploits work in two steps: first a local exploit (weak password with a user, stupid script escaping bug, or a buffer overflow somewhere), then a local kernel exploit to gain root and kernel access. (for a rootkit and what not)
Straight remote root exploits are pretty rare - and per system relinking only protects against that.
The problem with your relinking solution is that a local attacker can easily figure out where the kernel is. So this does not protect against the more common break-in scenario.
Kernel image randomization makes this last step really indeterministic and thus dangerous to attackers.
Thanks,
Ingo
| |