Currently, isoalloc has zones in increasing power of two, for performance reasons.
Unfortunately, this means that an attacker aiming at exploiting an UAF against an object of size N only needs to find an object of size between the previous and the next power of two, to be able to get it allocated with reasonable confidence (quarantine notwithstanding).
Introducing a bit of randomness in the granularity will make the life of an attacker without the ability to leak too much data a bit harder, since they would have no way to be sure that they managed to allocate the object of their choosing in the same zone as the freed-and-to-be-reused object.
Currently, isoalloc has zones in increasing power of two, for performance reasons.
Unfortunately, this means that an attacker aiming at exploiting an UAF against an object of size
Nonly needs to find an object of size between the previous and the next power of two, to be able to get it allocated with reasonable confidence (quarantine notwithstanding).Introducing a bit of randomness in the granularity will make the life of an attacker without the ability to leak too much data a bit harder, since they would have no way to be sure that they managed to allocate the object of their choosing in the same zone as the freed-and-to-be-reused object.