Address Space Layout Randomization

security memory

Definition

Address Space Layout Randomization (ASLR)

Address Space Layout Randomization (ASLR) is a kernel-level defence that randomises the base address of the stack, heap, and loaded libraries (libc, ld, etc.) on every execution. The attacker can no longer hardcode "system is at 0x7ffff8015c30" because that address is different every run. The randomisation is per-run, per-region, and re-applied on every exec.

Main ELF Not Randomized

The gap ASLR leaves

Under ASLR the main ELF base address stays constant across runs — only the libraries, heap, and stack are randomised. So the binary’s own .text, .plt, .rodata segments keep their addresses fixed, and the in-binary ROP gadgets (as found by objdump, e.g. & (pop rdi ; ret) at 0x4017cf) stay where the attacker found them. ASLR alone does not stop ret2plt or in-binary ROP; closing the gap on the binary’s own segments is what PIE is for.

Page Alignment

Page-aligned limits the entropy

ASLR randomizes the base of each region, but the base is always page-aligned (4 KiB on x86-64). All addresses inside the region keep their relative offsets — only the high-order bits vary. This is why leaking a single libc address is enough to de-randomise the whole library: once the base is recovered, every symbol at a known offset is at a known absolute address. The cost of one leak is libc, and the whole ASLR defence is therefore a leak-defence in disguise.

Bypass

Three ways to undo the randomisation

• Information leaks. Leaking one address undoes ASLR for an entire region: the base address is the leaked address minus the known offset of the leaked symbol, and from the base every other symbol is at a fixed offset. Buffer over-reads are the canonical leak vector; the buffer over-read note describes how that works in general. Requires the attacker to know which libc version is in use (so the offset is known).
• Partial overwrite. The low-order bytes of a randomised address are typically not randomised (within a page the layout is preserved), so overwriting only the least-significant bytes of a function pointer or the saved rip can land on a useful nearby target. When the number of unknown bits is small, brute force also becomes feasible — guessing a 4-bit nibble is a ~1/16 chance per attempt.
• ret2plt. The PLT is in the binary, not randomised under ASLR alone, so system@plt is at a fixed address with no leak needed. ASLR does not stop ret2plt; PIE does.