Researcher Finds Hole in Windows ASLR Security Defense
The latest versions of Microsoft Windows are vulnerable to attacks due to a newly discovered vulnerability in Address Space Layout Randomization (ASLR).
The vulnerability affects Windows 8, Windows 8.1, and Windows 10 systems with system-wide ASLR enabled via Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) or Windows Defender Exploit Guard.
Will Dormann, a senior vulnerability analyst at Carnegie Mellon’s CERT-CC discovered and reported the vulnerability. System-wide mandatory ASLR on all affected systems, enabled via EMET, has zero entropy, “essentially making it worthless,” he explained on Twitter.
His discovery means an attacker can more easily exploit memory corruption vulnerabilities in Windows 8 and newer systems, which ASLR would normally protect. The advantage of ASLR is it makes exploiting memory corruption bugs more difficult; however, it isn’t working as intended.
ASLR arrived in Windows Vista to prevent code-reuse attacks, which rely on code executing at predictable memory locations, by loading executable modules at random addresses. Starting in Windows 8, Microsoft began to offer system-wide mandatory ASLR. Admins could enable programs to randomize locations even for applications without ASLR support.
EMET is a free tool Microsoft previously released to protect applications not opted into ASLR and other exploit mitigation tools. Admins could enable them through the EMET interface. When Microsoft launched the Windows 10 Fall Creators Update, it integrated EMET’s key capabilities into the Windows Defender Exploit Guard.
Exploit Guard has an option to enable system-wide bottom-up ASLR. However, as Dormann discovered, setting system-wide ASLR in Windows, Windows 8.1, and Windows 10 does not actually randomize memory locations. If the default GUI in Exploit Guard says “On by default,” programs will still be relocated, but to the same address across different reboots and systems.
This could lead to a “wide variety” of common types of attacks, explains a DHS spokesman.
People who believe they are protected by ASLR may take risks they wouldn’t normally take; for example, opening an attachment in an unsolicited message. If the message is a spearphish and ASLR is working properly, the exploit would fail. However, without ASLR, the attacker could gain complete control of the victim’s system and view their access to other systems.
Microsoft says the problem is not a flaw. It says the issue, discovered by CMU’s CERT/CC and reported by US-CERT, is with configuring non-default settings for ASLR using Exploit Guard and EMET, and providing workarounds. The company is investigating and will address the configuration issue.
“The issue described by the US CERT is not a vulnerability,” a Microsoft spokesperson says. “ASLR is functioning as designed and customers running default configurations of Windows are not at increased risk.”
CERT/CC is currently unaware of a practical solution to the problem, Dormann says, adding a workaround for administrators in his blog post on the discovery. He advises enabling both bottom-up and mandatory ASLR system-wide for all systems running Windows 8 or later, using a certain registry value. Businesses should also use defense-in-depth strategies to protect networks, users, and data from unauthorized access, he adds.
Related Content:
- North Korea’s Lazarus Group Evolves Tactics, Goes Mobile
- Terdot Banking Trojan Spies on Email, Social Media
- Forget APTs: Let’s Talk about Advanced Persistent Infrastructure
- White House Releases New Charter for Using, Disclosing Security Vulnerabilities
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.
Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio
