# Address Space Layout Randomization Next Generation
## 7 ASLR-NG: Address Space Layout Randomization Next Generation
### Fine Grain Configuration  
Each profile mode is defined by a set of features. Table 3 lists the ASLR-NG configuration options enabled on each mode.  
* Sub-page in ARGV: ASLR-NG randomizes all the sub-page align bits. Although the arguments/environment are in the stack area, the page align bits of ARGV can be randomized.
* Randomize direction: the direction of a specific-zone is re-randomized for every new allocation. As a result, even libraries that typically are loaded sequentially will have some degree of randomness, which is especially useful in the concentrated profile, because it shuffles objects.
* Specific-zone for huge pages: if enabled, ASLR-NG uses a different specific-zone to map huge pages and therefore huge pages are completely isolated and correlation attacks abusing of its low entropy are not longer possible.
* Specific-zone for thread stacks: If enabled, thread stacks are allocated in a designated specific-zone. This no only prevents correlation attacks but also separate its data content from the libraries since both are by default in the same area.
* Inter-Object to Stack, Executable and Heap: each one of these objects is independently randomized, which is the default behavior for Linux and PaX. It was added to support the concentrated mode by disabling it.
* Randomize specific-zones per child: When a new child is spawned, all specific-zones are renewed, which results in a different memory map between the parent and the child, as well as any siblings among them.
* Sub-page in heap and thread stacks: applies sub-page randomization to the thread stacks and the heap. This feature can also be used from user-land on a per object basis, by calling the mmap() with the new flag MAP_INTRA_PAGE.
* Isolate thread stacks: randomizes thread stacks individually. This feature can also be requested by using the MAP_RND_OBJECT flag when calling mmap().  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline \multirow{2}{*}{**Feature**} & \multicolumn{4}{c}{**Nodes**} \\ \cline{2-5}  & **1** & **2** & **3** & **4** \\ \hline Sub-page in ARGV & ✓ & ✓ & ✓ & ✓ \\ Randomize direction & ✓ & ✓ & ✓ & ✓ \\ Bit-slicing & & ✓ & ✓ & ✓ \\ Isolate stack, executable and heap & & ✓ & ✓ & ✓ \\ Specific-zone for huge pages & & ✓ & ✓ & ✓ \\ Randomize specific-zones per child & & & ✓ & ✓ \\ \hline Sub-page in heap and thread stacks & & & ✓ & ✓ \\ Specific-zone for thread stacks & & & ✓ & \\ Specific-zone for read-write-exec objects & & ✓ & \\ Specific-zone for exec objects & & ✓ & \\ Isolate thread stacks & & & ✓ \\ Isolate LD and vDSO & & ✓ & ✓ \\ \hline Isolate all objects & & ✓ & \\ \hline \hline \end{tabular}
\end{table}
Table 3: ASLR-NG mode definition.  
* Isolate LD and vDSO: by enabling this feature, ASLR-NG loads these objects individually instead of using the classic library/mmap zone.
* Bit-slicing: enabling this feature, ASLR-NG generates a random number at boot time which is later used to improve the entropy of some objects when they must be aligned, typically for cache aliasing performance. Instead of setting the sensitive bits to zero, they are set to the random value generated at boot. We have used the core idea of this novel randomization form to address a security issue in the Linux kernel 4.1, to increase entropy by 3 bits in the AMD Bulldozer processor family [31].
* Isolate all objects: all objects are independently randomized. The leakage of any object cannot be used to de-randomize any other. This feature can be used in very exposed or critical environments where security is paramount.