Address Space Layout Randomization

Address Space Layout Randomization
Name	Address Space Layout Randomization
Type	Security mitigation
Introduced	2000s
Related	Data Execution Prevention, ASLR-compatible heap, stack canaries

Address Space Layout Randomization Address Space Layout Randomization is a memory-protection technique that varies the locations of process memory regions to impede exploitation, described in academic literature and implemented by vendors such as Microsoft, Apple Inc., Red Hat, Canonical Ltd., and contributors from University of California, Berkeley. The mechanism was motivated by high-profile incidents like the Morris worm and research from groups at Massachusetts Institute of Technology, University of Cambridge, and industrial labs including Google and Intel Corporation. It is discussed alongside mitigations in work by authors from Carnegie Mellon University, University of California, Santa Barbara, and standards bodies such as Internet Engineering Task Force.

Overview

ASLR randomizes addresses for memory regions including executables, libraries, stacks, and heaps to reduce the success probability of memory corruption exploits; this concept has been compared in literature from DARPA-funded projects and security analyses by teams at Symantec, Kaspersky Lab, and Trend Micro. The technique complements protections like Data Execution Prevention and is often evaluated in vulnerability reports by CERT Coordination Center, advisories from National Institute of Standards and Technology, and conference presentations at USENIX, Black Hat, and DEF CON. Designers from Microsoft Research, Apple Inc., and academic groups at Princeton University and Stanford University have proposed variations that balance entropy, performance, and compatibility with legacy binaries.

History and Development

Early concepts predate modern OS deployments and were influenced by research at Bell Labs and publications by researchers affiliated with University of California, Berkeley and MIT. Commercial adoption accelerated after demonstrations at conferences such as Black Hat and publications in ACM and IEEE venues by teams including personnel from Microsoft Research and Google. Major milestones include integration into OpenBSD, kernels maintained by Linus Torvalds in the Linux kernel, and later adoption in desktop and server releases by Apple Inc. for macOS and by Microsoft for Windows Vista and later. Standards and best practices were debated in forums involving representatives from Red Hat, Canonical Ltd., FreeBSD Foundation, and security groups at Cisco Systems.

Implementation Techniques

Implementations modify loader behavior in projects such as the GNU Project's glibc and runtime linkers used by FreeBSD, NetBSD, and OpenBSD to relocate sections at process start, with variants using high-entropy randomization in 64-bit architectures promoted by AMD and Intel Corporation. Techniques include base-address randomization for position-independent executables (PIE), per-process, per-thread, and per-mmap randomization implemented in kernels maintained by Linus Torvalds and contributors at Red Hat and Debian. Compiler and toolchain support arises from projects like GCC and LLVM with contributions from teams at Apple Inc. and Google to produce position-independent code; runtime mitigations interact with memory allocators such as tcmalloc, jemalloc, and the allocators used in Mozilla's Firefox and Chromium projects.

Effectiveness and Limitations

ASLR’s effectiveness depends on entropy, implementation quality, and platform features documented in advisories from CERT Coordination Center and research papers from Cornell University and ETH Zurich, with practical limitations noted in reports by Microsoft Research and security firms such as Mandiant. Entropy loss can occur via information leakage through interfaces maintained by Oracle databases, web servers like Apache HTTP Server and nginx, or runtimes such as the Java Virtual Machine, leading to bypasses described in papers presented at IEEE Symposium on Security and Privacy and USENIX Security Symposium. Legacy binaries that lack PIE support or opt out on Windows or macOS reduce the coverage of ASLR on systems managed by Red Hat and Canonical Ltd. administrators.

Attacks and Bypasses

Researchers from Columbia University, University of California, Santa Barbara, and industry teams at Google and Microsoft have demonstrated bypasses using techniques including information leaks via JavaScript engines in Mozilla's Firefox and Google Chrome's V8, brute-force attacks against low-entropy implementations, and return-oriented programming chains revealed in exploit reports by Mandiant and case studies from Kaspersky Lab. Practical exploits have leveraged services such as OpenSSH, network daemons by ISC, and database servers like MySQL to obtain pointers, with defensive countermeasures described in advisories from NIST and remediation guidance from SANS Institute.

Adoption and Operating System Support

ASLR has been adopted across major operating systems: integrated into OpenBSD early by security engineers at the project, enabled in Linux kernel distributions by contributors associated with Red Hat and packaging teams at Debian and Ubuntu (Canonical Ltd.), rolled into macOS by engineers at Apple Inc., and incrementally deployed in Microsoft Windows releases maintained by teams at Microsoft. Support varies by version and distribution; enterprise operators at IBM and cloud providers such as Amazon Web Services and Microsoft Azure consider compatibility when enabling platform-wide policies, and mobile platforms by Google for Android and by Apple Inc. for iOS incorporate ASLR with platform-specific constraints.

Related Mitigation Technologies

ASLR is used alongside mitigations including Data Execution Prevention introduced by Microsoft, stack canaries implemented with compiler support from GCC and LLVM, control-flow integrity researched at ETH Zurich and MIT, and sandboxing approaches applied by Google in Chrome and by Mozilla in Firefox. Other related technologies include pointer authentication mechanisms promoted by ARM Holdings in architectures used by Apple Inc. and mitigations such as seccomp filters developed by contributors in the Linux kernel community and presented at USENIX and Black Hat.

Category:Computer security