From owner-svn-doc-all@FreeBSD.ORG Sat Oct 11 01:53:31 2014 Return-Path: Delivered-To: svn-doc-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4CBC8556; Sat, 11 Oct 2014 01:53:31 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 3868AF4; Sat, 11 Oct 2014 01:53:31 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id s9B1rVL4041154; Sat, 11 Oct 2014 01:53:31 GMT (envelope-from bjk@FreeBSD.org) Received: (from bjk@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id s9B1rVgF041153; Sat, 11 Oct 2014 01:53:31 GMT (envelope-from bjk@FreeBSD.org) Message-Id: <201410110153.s9B1rVgF041153@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: bjk set sender to bjk@FreeBSD.org using -f From: Benjamin Kaduk Date: Sat, 11 Oct 2014 01:53:31 +0000 (UTC) To: doc-committers@freebsd.org, svn-doc-all@freebsd.org, svn-doc-head@freebsd.org Subject: svn commit: r45786 - head/en_US.ISO8859-1/htdocs/news/status X-SVN-Group: doc-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-doc-all@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "SVN commit messages for the entire doc trees \(except for " user" , " projects" , and " translations" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Oct 2014 01:53:31 -0000 Author: bjk Date: Sat Oct 11 01:53:30 2014 New Revision: 45786 URL: https://svnweb.freebsd.org/changeset/doc/45786 Log: Add the ASLR report Approved by: hrs (mentor, blanket) Modified: head/en_US.ISO8859-1/htdocs/news/status/report-2014-07-2014-09.xml Modified: head/en_US.ISO8859-1/htdocs/news/status/report-2014-07-2014-09.xml ============================================================================== --- head/en_US.ISO8859-1/htdocs/news/status/report-2014-07-2014-09.xml Sat Oct 11 01:49:33 2014 (r45785) +++ head/en_US.ISO8859-1/htdocs/news/status/report-2014-07-2014-09.xml Sat Oct 11 01:53:30 2014 (r45786) @@ -2096,4 +2096,94 @@ + + + Address Space Layout Randomization (ASLR) + + + + + Shawn + Webb + + + shawn.webb@hardenedbsd.org + + + + Oliver + Pinter + + + oliver.pinter@hardenedbsd.org + + + + + The HardenedBSD Project + ASLR review + on Phabricator + + EXP-RUN test results + EuroBSDCon + 2014 Devsummit page on ASLR + + FreeBSD wiki page on ASLR + + + +

Address Space Layout Randomization (ASLR) is a computer + security technique that aids in mitigating low-level + vulnerabilities such as buffer overflows. In order to + prevent an attacker from knowing where a given + exploitable vulnerability lies in memory, ASLR randomizes + the memory layout of running applications.

+ +

FreeBSD lacks behind the industry in exploit mitigation + technologies. ASLR is a great first step in implementing + such technologies. Future exploit mitigation technologies + will rely on ASLR.

+ +

A lot has happened in the last few months. Shawn Webb gave + presentations at both BSDCan 2014 and EuroBSDCon 2014. The + presentations were met with a lot of support and backing. + At the end of EuroBSDCon, an awesome developer named Ilya + Bakulin fixed our ARM bug. Shawn Webb and Oliver Pinter + have submitted our patch to Phabricator, FreeBSD's new + code review utility. Shawn Webb added an API for allowing + a debugger to disable ASLR in order to support + deterministic debugging with applications such as lldb or + gdb. Oliver Pinter enhanced the performance of our ASLR + implementation. A package building exp-run was ran and came + out favorably in terms of performance. Shawn Webb bumped up + the maximum number of bits allowed to be randomized to 20 + and set the default to 14.

+ +

To aid in the upstreaming process of the ASLR project and + other security-related projects, Shan Webb and Oliver Pinter + founded The HardenedBSD project. It exists primarily to + serve as a staging area for bleeding-edge development of + security-related projects for FreeBSD prior to being merged + upstream.

+ + + + SoldierX + + + +

Get more people testing and reviewing our patch

+ + +

Run more performance tests

+ + +

Figure out why the two ports failed in the EXP-RUN. + Involve the port maintainers.

+ + +

Test on different architectures (we need help with this)

+ + +