musl - Binaries compiled with musl (1.1.2) are vulnerable to an ancient ldd exploit

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABz95_Ck39WgWtb+cAXnoE0hEZubE=xe3q8WRmtSiour4uUmfQ@mail.gmail.com>
Date: Sat, 14 Jun 2014 16:35:25 +0100
From: Steven Honeyman <stevenhoneyman@...il.com>
To: musl@...ts.openwall.com
Subject: Binaries compiled with musl (1.1.2) are vulnerable to an ancient ldd exploit

I noticed this by accident (ran ldd as usual without even thinking)...
but if you compile with musl-gcc, and use shared instead of static,
then ldd can cause different behaviour in the binary (code will
execute). It is described here [1] from 2009, on how to modify uclibc
to enable this behaviour... musl needs no mods to achieve this!

Simple example:

$ echo 'void main() { puts("executed"); }' >lddtest.c
$ musl-gcc lddtest.c && ldd ./a.out

Of course the exploit is only useable if you check for
LD_TRACE_LOADED_OBJECTS and do something different in the code if it
is set.

Thanks,
Steven.

[1] http://www.catonmat.net/blog/ldd-arbitrary-code-execution/

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.