[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20140614193917.GM179@brightrain.aerifal.cx>
Date: Sat, 14 Jun 2014 15:39:17 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: Binaries compiled with musl (1.1.2) are vulnerable to an
ancient ldd exploit
On Sat, Jun 14, 2014 at 10:37:25PM +0400, Solar Designer wrote:
> On Sat, Jun 14, 2014 at 02:29:42PM -0400, Rich Felker wrote:
> > Stock glibc accepts all of the LD_* environment variables for
> > suid/sgid, including dangerous ones, and only applies weak
> > restrictions to them (for example it even allows LD_PRELOAD after
> > imposing some insufficient conditions on the library to be preloaded).
>
> Oh, I recall it allows LD_PRELOAD on libraries that are placed in system
> directories and are themselves marked with the SUID bit. IIRC, libc5's
> dynamic linker had that, too.
Yes, I don't recall if there are other cases it allows or not, but I
think as long as you avoid setting the suid bit on any libraries, the
allowance seems safe. On the other hand, any actual use of this
feature is probably insecure. Some issues that come to mind, assuming
suid libraries are present:
- After an upgrade, if the old library is left behind, an attacker can
force the old version to be loaded in place of the new one in order
to exploit bugs that are fixed in the new version.
- If there exists any suid library which contains symbol names which
overlap with symbols that appear in other libraries, preloading it
can interpose definitions for these symbols which have nothing to do
with the actual functions/objects the application is trying to use
(from another library) and thereby cause runaway incorrect behavior
in an suid program.
I wouldn't be surprised if there are more related issues too..
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
