System Down: A systemd-journald exploit
Yet another proof for the following:<p>1. It&#x27;s reasonable to claim that amd64 (x86_64) is more secure than x86. x86_64 has larger address space, thus higher ASLR entropy. The exploit needs 10 minutes to crack ASLR on x86, but 70 minutes on amd64. If some alert systems have been deploy on the server (attacks need to keep crashing systemd-journald in this process), it buys time. In other cases, it makes exploitation infeasible.<p>2. CFLAGS hardening works, in addition to ASLR, it&#x27;s the last line of defense for all C programs. As long as there are still C programs running, patching all memory corruption bugs is impossible. Using mitigation techniques and sandbox-based isolation are the only two ways to limit the damage. All hardening flags should be turned on by all distributions, unless there is a special reason. Fedora turned &quot;-fstack-clash-protection&quot; on since Fedora 28 (<a href="https:&#x2F;&#x2F;fedoraproject.org&#x2F;wiki&#x2F;Changes&#x2F;HardeningFlags28" rel="nofollow">https:&#x2F;&#x2F;fedoraproject.org&#x2F;wiki&#x2F;Changes&#x2F;HardeningFlags28</a>).<p>If you are releasing a C program on Linux, please consider the following,<p><pre><code>    -D_FORTIFY_SOURCE=2         glibc hardening

    -Wp,-D_GLIBCXX_ASSERTIONS   glibc++ hardening

    -fstack-protector-strong    stack smash protection

    -fstack-clash-protection    stack clash protection

    -fPIE -pie                  better ASLR protection

    -Wl,-z,noexecstack          don&#x27;t allow code on stack

    -Wl,-z,relro                ELF hardening

    -Wl,-z,now                  ELF hardening
</code></pre>
Major Linux distributions, including Fedora, Debian, Arch Linux, openSUSE are already doing it. Similarly, Firefox and Chromium are using many of these flags too. Unfortunately, Debian did not use `-fstack-clash-protection` and got hit by the exploit, because it was only added since GCC 8.<p>For a more comprehensive review, check<p>* Recommended compiler and linker flags for GCC:<p><i></i> <a href="https:&#x2F;&#x2F;developers.redhat.com&#x2F;blog&#x2F;2018&#x2F;03&#x2F;21&#x2F;compiler-and-linker-flags-gcc&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developers.redhat.com&#x2F;blog&#x2F;2018&#x2F;03&#x2F;21&#x2F;compiler-and-l...</a><p>* Debian Hardening<p><i></i> <a href="https:&#x2F;&#x2F;wiki.debian.org&#x2F;Hardening" rel="nofollow">https:&#x2F;&#x2F;wiki.debian.org&#x2F;Hardening</a>