{"push_id":732719233,"size":1,"distinct_size":1,"ref":"refs/heads/cm-12.1","head":"c749a0c33ced30abdf1a861d22d3ccb743091376","before":"72a3fd84ada047ea07f6ee99736259c0db19a59a","commits":[{"sha":"c749a0c33ced30abdf1a861d22d3ccb743091376","author":{"email":"28efa798da98745d6a98078b320edd33f229eda6@gmail.com","name":"Daniel Micay"},"message":"add two forms of ASLR for secondary stacks\n\nA randomly sized mapping is placed above secondary stacks mapped by\nlibc, up to 10% as large as the stack on 32-bit and 50% on 64-bit where\nvirtual memory is plentiful. This provides a random base, making\nexploits involving overflows from the stack unreliable. It also slightly\nreduces the utility of a leaked stack address as the location of data\nabove the stack won't be precisely known. There is no change to the\npthread API as it's accounted for separately from the stack itself. It's\nessentially a userspace implementation of grsecurity's RAND_THREADSTACK,\nalthough it triggers a segmentation fault instead of immediate death.\n\nThe initial stack pointer is also placed at a random offset within the\ninitial page, using up to 5% of the stack's memory. This also applies to\nstacks allocated outside of libc. The granularity of this randomization\nis determined by the minimum stack alignment which is currently assumed\nto be 16. This provides 8-bit entropy with typical 4096 byte pages and\nthe default stack size is large enough to get the full benefit. It makes\nexploits requiring precise offsets unreliable and the also provides\ncache coloring, improving performance for threads with similar data\nlayout on the stack.","distinct":true,"url":"https://api.github.com/repos/copperhead-security/android_bionic/commits/c749a0c33ced30abdf1a861d22d3ccb743091376"}]}