Reply To: ASLR (security)

Say the program works as you describe but the service is poorly written instead. It receives variable length data over IPC and copies it into a statically sized buffer. The buffer stil overflows and potentially overwrites function pointers in that service, causing it to return true instead of false. The exploit is essentially the same and is still possible even for two separate machines communicating over a network, and is still thwarted by ASLR.

I completely agree that ASLR is only a mitigator for underlying problems, but that’s an argument for it having less value rather than none at all. In practice many exploits are thwarted by it.