CompTIA Security+ (SY0-701)Threats, Vulnerabilities, and MitigationsHard
A security engineer is reviewing mitigations for a memory-corruption vulnerability in a compiled application. The engineer wants a defense that randomizes the memory addresses of key application areas (stack, heap, libraries) each time the program runs, making it harder for an attacker to reliably predict the location of injected shellcode. Which mitigation technique does this describe?
- AInput validation
- BData Execution Prevention (DEP)
- CStack canaries
- DAddress Space Layout Randomization (ASLR)
Show answer & explanationAnswer & explanation
Correct answer: D. Address Space Layout Randomization (ASLR)
ASLR randomizes the memory addresses used by the stack, heap, and loaded libraries on each execution, making it far more difficult for an attacker exploiting a buffer overflow to predict where to jump for reliable code execution. DEP prevents execution of code in data regions but does not randomize addresses, and stack canaries detect stack overflow corruption rather than randomizing memory layout.
Why the other options are wrong
- A. Input validation restricts what data is accepted but does not address memory address predictability at runtime.
- B. DEP marks memory regions as non-executable but does not randomize addresses; it complements but is distinct from ASLR.
- C. Stack canaries place a check value before the return address to detect overflow, not to randomize memory locations.
Address Space Layout Randomization (ASLR)
An operating system security feature that randomizes the memory locations of key process areas (stack, heap, libraries) on each execution to hinder exploitation of memory-corruption vulnerabilities.
- Randomizes memory layout at each program launch
- Often paired with DEP/NX for stronger protection
- Increases difficulty of reliably locating shellcode or return addresses
Memory trick: ASLR shuffles the deck every time the program deals memory addresses.