Does 57bit 5-level paging improve security (ASLR entropy) ?

O

OpenSource Ghost

Limp Gawd
Joined
Feb 14, 2022
Messages
237
Windows enables 57-bit 5-level paging feature by default. it is mostly designed to increase addressable virtual memory (https://en.wikipedia.org/wiki/Intel_5-level_paging), but does it offer any security benefits? For example, 64bit offers better Address Space Layout Randomization (ASLR) entropy compared to 32bit, but 64bit actually offers 48bits 4-level paging, making 57bit the next step-up. I don't have deep understanding of it...

Questions:
1. Does 57bit addressing 5-level paging provides any security benefits over 48-bit 4-level paging in scenarios that involve attacks of Windows kernel?
2. Do applications have to be coded to take security advantage of 57bit 5-level paging Windows 11 kernel extension?
 
Imagining adding a dedicated PSU just for the memory.

Imagining how long memtest would need to run.

But maybe I'm a bit too old and stuck on "256 TB should be enough for anybody".
 
It looks like it requires bit 12 to be enabled in CR4 (Control Register 4). Is that something a motherboard maker has to enable?

Is it possible to check whether such a bit is enabled?
 
OpenSource Ghost said:
Windows enables 57-bit 5-level paging feature by default. it is mostly designed to increase addressable virtual memory (https://en.wikipedia.org/wiki/Intel_5-level_paging), but does it offer any security benefits? For example, 64bit offers better Address Space Layout Randomization (ASLR) entropy compared to 32bit, but 64bit actually offers 48bits 4-level paging, making 57bit the next step-up. I don't have deep understanding of it...

Questions:
1. Does 57bit addressing 5-level paging provides any security benefits over 48-bit 4-level paging in scenarios that involve attacks of Windows kernel?
2. Do applications have to be coded to take security advantage of 57bit 5-level paging Windows 11 kernel extension?
Click to expand...

Doesn't look like there's security benefits - maybe indirectly? Seems like the main purpose is just more address space.

Generally, applications won't need to care - the size of a pointer hasn't changed with this feature and it's still 64-bit. The OS needs support for it, though.

OpenSource Ghost said:
It looks like it requires bit 12 to be enabled in CR4 (Control Register 4). Is that something a motherboard maker has to enable?

Is it possible to check whether such a bit is enabled?
Click to expand...

If the OS doesn't expose it via an API or something, you will need a Kernel mode driver. In user space, the processor will just raise an exception and the OS will kill your program.

You probably can modify it from your driver at any time, but there's probably a decent chance you'll bring the system down in flames if you naively do it while the OS is running. I'm assuming you'll crash and it's something the kernel should know about and handle at boot time because it'll effect the memory manager.
 
Looks like it needs hardware support, OS support, and driver suport.

When trying to launch la57setup.exe, I get "5-level-paging is not supported on this platform", even though CPU supports it. What a mystery.
 
philb2 said:
??


Why longer with this 5-level paging?

I'm stuck on 128 bit CPU architecture should be enough for anybody. Or should it really be 256 bit? Dunno.
Click to expand...
The main reason for this (extra indirect) would be to expand the current limits on memory size.
 
You must log in or register to reply here.
Back
Top