Researcher Finds Hole in Windows ASLR Security Defense

The latest versions of Microsoft Windows are vulnerable to attacks due to a newly discovered vulnerability in Address Space Layout Randomization (ASLR).

The vulnerability affects Windows 8, Windows 8.1, and Windows 10 systems with system-wide ASLR enabled via Microsoft's Enhanced Mitigation Experience Toolkit (EMET) or Windows Defender Exploit Guard.

Will Dormann, a senior vulnerability analyst at Carnegie Mellon's CERT-CC discovered and reported the vulnerability. System-wide mandatory ASLR on all affected systems, enabled via EMET, has zero entropy, "essentially making it worthless," he explained on Twitter.

Dormann was investigating Microsoft Office vulnerability CVE-2017-11882 when he found the issue. He wanted to see which exploit mitigations potentially already in place could have prevented exploitation of CVE-2017-11882. Dormann noticed even if mandatory ASLR was enabled on his machine, the code loaded at the same location every time. The load address was not actually being randomized.

His discovery means an attacker can more easily exploit memory corruption vulnerabilities in Windows 8 and newer systems, which ASLR would normally protect. The advantage of ASLR is it makes exploiting memory corruption bugs more difficult; however, it isn't working as intended.

ASLR arrived in Windows Vista to prevent code-reuse attacks, which rely on code executing at predictable memory locations, by loading executable modules at random addresses. Starting in Windows 8, Microsoft began to offer system-wide mandatory ASLR. Admins could enable programs to randomize locations even for applications without ASLR support.

EMET is a free tool Microsoft previously released to protect applications not opted into ASLR and other exploit mitigation tools. Admins could enable them through the EMET interface. When Microsoft launched the Windows 10 Fall Creators Update, it integrated EMET's key capabilities into the Windows Defender Exploit Guard.

Exploit Guard has an option to enable system-wide bottom-up ASLR. However, as Dormann discovered, setting system-wide ASLR in Windows, Windows 8.1, and Windows 10 does not actually randomize memory locations. If the default GUI in Exploit Guard says "On by default," programs will still be relocated, but to the same address across different reboots and systems.

Dormann likens the issue to buying a high-security deadbolt to add to an existing lock on your front door, only to dealize the deadbolt lock doesn't actually activate when turned. The result: you don't have as much protection as you think you do.

This could lead to a "wide variety" of common types of attacks, explains a DHS spokesman.

People who believe they are protected by ASLR may take risks they wouldn't normally take; for example, opening an attachment in an unsolicited message. If the message is a spearphish and ASLR is working properly, the exploit would fail. However, without ASLR, the attacker could gain complete control of the victim's system and view their access to other systems.

Microsoft says the problem is not a flaw. It says the issue, discovered by CMU's CERT/CC and reported by US-CERT, is with configuring non-default settings for ASLR using Exploit Guard and EMET, and providing workarounds. The company is investigating and will address the configuration issue.

"The issue described by the US CERT is not a vulnerability," a Microsoft spokesperson says. "ASLR is functioning as designed and customers running default configurations of Windows are not at increased risk."

However, Dormann says when it comes to deciding whether this is a vulnerability or not, this problem is "a little bit tricky." It's not a vulnerability that an attacker can directly exploit; however, it is an issue where users' expectations of protection are not met.

"If a user enables system-wide mandatory ASLR, the user should rightfully expect that code is forced to be randomized on a system-wide basis," he explains. "But this is not the case with Windows 8 or later systems, due to a change in how mandatory ASLR is implemented in Windows."

CERT/CC is currently unaware of a practical solution to the problem, Dormann says, adding a workaround for administrators in his blog post on the discovery. He advises enabling both bottom-up and mandatory ASLR system-wide for all systems running Windows 8 or later, using a certain registry value. Businesses should also use defense-in-depth strategies to protect networks, users, and data from unauthorized access, he adds.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.