tl;dr: in my distros linux 3.08 kernel using
cat /proc/kallsyms I can find out that for instance the _commit_creds function/symbol is located at address 0xc1073fe0. When either:
- building my kernel (option 1)
- via tweaking the kernel binary (option 2)
is it possible to influence those addresses? (i.e. randomize to mitigate exploits to the kernel?)
Am I further correctly assuming that the system calls provided by the kernel need to remain at predictable/know addresses to not break the ABI provided by the kernel?
#define COMMIT_CREDS_ADDR (0xffffffff81094250) #define PREPARE_KERNEL_CREDS_ADDR (0xffffffff81094550)
which even though they play their role only after an overflow-with-use-after-free type of problem has occured, are nonetheless essential to complete the priveledge escalation. Of course the addresses are not the same for all kernels and basically change for each distribution. Anyway it seems that they are constant within the line of kernels (i.e. Ubuntu 12.04 x86 will always have the address at 0xc1073fe0).
My question is to understand if one can influence those addresses to shuffle/randomize them as to make an exploitation of the kernel more difficult (i.e. somewhat blind the attacker, after having the instruction pointer in kernel ring 0)? I would assume that in order to have a ABI for system calls I cannot change the position of sys_xxxxxxxxxxx symbols, but at least for the internals of kernel symbols I do not necessarily understand the need to have them be predictable?
Therefore I am asking here how one would go about randomizing those kernel symbols, either by
- (1) compile custom kernel or,
- (2) even better tweak a kernel and move the symbols around (which I think might be much harder and more fragile thing to do).
What is the consequence when changing the addresses of kernel symbols? (excluding the system call ABI ones).