Libc symbols randomization
Announced in 2016,
this feature randomizes, at boot time, the order of group of symbols in the
This mitigation is subject to roughly the same limitations than the library order randomization one: defeated by arbitrary read (just dump the GOT), and circumvented by BROP. It’s also interesting to note that the randomization happens only at boot-time, meaning that this feature can only protect against remote attackers without large-enough or repeatable leaks, completely killing single-pointer leaks, as well as relative write happening in libc and libcrypto.
To quote halvar flake on this:
A stupid idea, unfortunately. Only academia still cares about ROP. http://undeadly.org/cgi?action=article&sid=20160425145953 - sorry theo.
It’s similar to the selfrando project (paper), initially designed to be used by the Tor Browser to improve its security, but that was removed after a couple of months, because of its inefficiency against attackers. But selfrando was used in an environment where an attacker has a lot of control of what is happening, which is usually not the cases outside of web browsers.
It doesn’t add complexity nor hinder the performances, kills some exploits: it’s a cool one.