Q. Does Address Space Load Randomization (ASLR) break hypervisors that perform page sharing?

A. Some hypervisors, such as VMware's, perform Transparent Page Sharing (TPS). TPS examines the memory of all virtual machines on a host and pages that contain the same data between the guests are stored only once in memory and shared. If you imagine having five copies of Windows Server 2008 running on a single host, a huge amount of the information in memory for the OS will be the same, so TPS can save you a lot of physical host memory usage. See this FAQ and this FAQ for more about TPS.

With Server 2008 and later, key areas of memory that could be attacked through buffer overruns, use ASLR so that the same memory areas aren't always used for specific pieces of code. Because the core OS code could be located in 256 possible places, no two Server 2008 or above OS instances would use the same areas of memory for pieces of OS code. The concern is that this would break TPS.

The good news is that studies have found that even with ASLR enabled, TPS will find a lot of duplicated content in memory, saving on physical host memory usage for multiple guest OS instances. While the total amount of memory used for each OS has increased, this increase is probably due to the Server 2008 and Vista OSs actually using more memory than Windows Server 2003 and Windows XP.

Related Reading:

Check out hundreds more useful Q&As like this in John Savill's FAQ for Windows. Also, watch instructional videos made by John at ITTV.net.