How can I temporarily disable ASLR (Address space layout randomization)?

According to an article How Effective is ASLR on Linux Systems?, you can configure ASLR in Linux using the /proc/sys/kernel/randomize_va_space interface.

The following values are supported:

  • 0 – No randomization. Everything is static.
  • 1 – Conservative randomization. Shared libraries, stack, mmap(), VDSO and heap are randomized.
  • 2 – Full randomization. In addition to elements listed in the previous point, memory managed through brk() is also randomized.

So, to disable it, run

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

and to enable it again, run

echo 2 | sudo tee /proc/sys/kernel/randomize_va_space

This won't survive a reboot, so you'll have to configure this in sysctl. Add a file /etc/sysctl.d/01-disable-aslr.conf containing:

kernel.randomize_va_space = 0

should permanently disable this.


The /proc/sys/kernel/randomize_va_space interface controls ASLR system-wide.

If you don't want a system-wide change, use ADDR_NO_RANDOMIZE personality flag to temporarily disable ASLR. Controlling of this flag can be done with setarch and its -R option, like

setarch `uname -m` -R /bin/bash

This will open a new Bash shell for you with ASLR disabled, including all child processes run from this shell. Just exit the shell once you're done.


By the way, on i386, ulimit -s unlimited can effectively "disable" ASLR.

EDIT (Apr 2016): The ulimit -s unlimited was fixed and assigned CVE-2016-3672.


The more permanent ways of disabling ASLR should be kept in a VM for obvious reasons.

to test the ability to overwrite stack frame return addresses etcetera, you'll need to compile without stack canaries -fno-stack-protector, while to allow you to execute code on the stack you need to compile with -z execstack, making

$ gcc -fno-stack-protector -z execstack -o <my_program> my_code.c

Tags:

Kernel