tech-kern archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: kernel aslr: someone interested?

In article <>,
Greg Troxel  <> wrote:
>Maxime Villard <> writes:
>> I would also add - even if it is not a relevant argument - that most
>> "commonly-used" operating systems do have kernel aslr: Windows, Mac, Linux,
>> etc.
>There's another point, which various people may also consider invalid :-)
>In the US, there's a federal computer security standard NIST 800-53, and
>essentially a subset of that NIST 800-171, and more or less all federal
>contractors handling non-public information have to implement it.  There
>are a lot of security controls, and exploit mitigation is one of them.
>I am not claiming that kernel ASLR is a requirement.  But, I would hate
>to see people in these environments be told not to use NetBSD because it
>lacks some security controls compared to alternatives.

I think that nobody disputes that ASLR significantly raises the barrier
to entry (amount of work) that attackers need to perform in most cases.


Home | Main Index | Thread Index | Old Index