시스템 보안 - 리눅스 커널 ASLR 메모리 보호 기법 설정(randomize_va_space)

 

ASLR(Address Space Layout Randomization)이란?

메모리 공격을 방어하기 위해 주소 공간 배치를 난수 화하는 기법으로 실행 시마다 메모리 주소를 변경시켜 악성코드에 의한 특정주소 호출을 방지한다. 

 

리눅스 ASLR 적용 (/proc/sys/kernel/randomize_va_space 수정)

echo 0 > /proc/sys/kernel/randomize_va_space # ASLR 미설정
echo 1 > /proc/sys/kernel/randomize_va_space # ASLR 부분설정(heap만 미설정)
echo 2 > /proc/sys/kernel/randomize_va_space # ASLR 모두설정(stack, heap, library 등)

 

sysctl 명령어로 리눅스 커널 파라미터 확인 및 설정

 

sysctl -n kernel.randomize_va_space # ASLR 상태 확인
sysctl -w kernel.randomize_va_space=2 # ASLR 상태 설정

 

 

ASLR 적용 확인

 

ASLR.c

#include <stdio.h>

int a = 10;
int c;

int main()
{
    static int b = 20;
    static int d;

    char *heap = (char *)malloc(100);

    int stack;

    printf("    ==========[code section]==========\n");
    printf("    main() addr : 0x%08x\n",&main);
    printf("    ==========[data section]==========\n");
    printf("    valu a addr : 0x%08x\n",&a);
    printf("    valu b addr : 0x%08x\n",&b);
    printf("    ==========[BSS section]==========\n");
    printf("    valu c addr : 0x%08x\n",&c);
    printf("    valu d addr : 0x%08x\n",&d);
    printf("    ==========[heap section]==========\n");
    printf("    [!] heap addr : 0x%08x\n",heap);
    printf("    ==========[stack section]==========\n");
    printf("    [!] stack addr : 0x%08x\n",&stack);

    return 0;
}

 

root@kali:~/Desktop# gcc ASLR.c -o ASLR.out

 

 

소스 코드 출저: https://hackstoryadmin.tistory.com/entry/Linux-Memory-Protection-ASLR

 

 

ASLR을 미적용하였을 경우(echo 0 > /proc/sys/kernel/randomize_va_space)

 

root@kali:~/Desktop# ./ASLR.out 
    ==========[code section]==========
    main() addr : 0x0804847c
    ==========[data section]==========
    valu a addr : 0x0804992c
    valu b addr : 0x08049930
    ==========[BSS section]==========
    valu c addr : 0x0804993c
    valu d addr : 0x08049938
    ==========[heap section]==========
    [!] heap addr : 0x0804a008
    ==========[stack section]==========
    [!] stack addr : 0xbffff478
root@kali:~/Desktop# ./ASLR.out 
    ==========[code section]==========
    main() addr : 0x0804847c
    ==========[data section]==========
    valu a addr : 0x0804992c
    valu b addr : 0x08049930
    ==========[BSS section]==========
    valu c addr : 0x0804993c
    valu d addr : 0x08049938
    ==========[heap section]==========
    [!] heap addr : 0x0804a008
    ==========[stack section]==========
    [!] stack addr : 0xbffff478

 

결과: 변함없음

 

 

ASLR을 부분 적용하였을 경우(echo 1 > /proc/sys/kernel/randomize_va_space)

 

root@kali:~/Desktop# ./ASLR.out 
    ==========[code section]==========
    main() addr : 0x0804847c
    ==========[data section]==========
    valu a addr : 0x0804992c
    valu b addr : 0x08049930
    ==========[BSS section]==========
    valu c addr : 0x0804993c
    valu d addr : 0x08049938
    ==========[heap section]==========
    [!] heap addr : 0x0804a008
    ==========[stack section]==========
    [!] stack addr : 0xbf86ccb8
root@kali:~/Desktop# ./ASLR.out 
    ==========[code section]==========
    main() addr : 0x0804847c
    ==========[data section]==========
    valu a addr : 0x0804992c
    valu b addr : 0x08049930
    ==========[BSS section]==========
    valu c addr : 0x0804993c
    valu d addr : 0x08049938
    ==========[heap section]==========
    [!] heap addr : 0x0804a008
    ==========[stack section]==========
    [!] stack addr : 0xbfd22678

 

결과: heap 영역 외에 stack 영역이 실행될 때마다 랜덤 하게 변경한다. 

 

 

ASLR을 모두 적용하였을 경우(echo 2 > /proc/sys/kernel/randomize_va_space)

 

root@kali:~/Desktop# ./ASLR.out 
    ==========[code section]==========
    main() addr : 0x0804847c
    ==========[data section]==========
    valu a addr : 0x0804992c
    valu b addr : 0x08049930
    ==========[BSS section]==========
    valu c addr : 0x0804993c
    valu d addr : 0x08049938
    ==========[heap section]==========
    [!] heap addr : 0x086ff008
    ==========[stack section]==========
    [!] stack addr : 0xbfbf4748
root@kali:~/Desktop# ./ASLR.out 
    ==========[code section]==========
    main() addr : 0x0804847c
    ==========[data section]==========
    valu a addr : 0x0804992c
    valu b addr : 0x08049930
    ==========[BSS section]==========
    valu c addr : 0x0804993c
    valu d addr : 0x08049938
    ==========[heap section]==========
    [!] heap addr : 0x089c4008
    ==========[stack section]==========
    [!] stack addr : 0xbfab8598

 

결과: 모든 영역이(heap, stack) 실행될 때마다 랜덤하게 변경한다.