[nwmcsween]

You just described the old method Linux used that was vulnerable to info leaks iirc and why it now a vDSO

[binarycrusader]

The Solaris method doesn't have the problem the other implementation did.

[nwmcsween]

How does solaris find the page? If it's mapped to a fixed address then it does have that problem.

[binarycrusader]

The default is to map the shared page to a randomized, available address within the process space.

libc gets the address of the page by looking it up in an auxiliary vector table that belongs to the process.