[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 14 Jun 2014 16:35:25 +0100
From: Steven Honeyman <stevenhoneyman@...il.com>
To: musl@...ts.openwall.com
Subject: Binaries compiled with musl (1.1.2) are vulnerable to an ancient ldd exploit
I noticed this by accident (ran ldd as usual without even thinking)...
but if you compile with musl-gcc, and use shared instead of static,
then ldd can cause different behaviour in the binary (code will
execute). It is described here [1] from 2009, on how to modify uclibc
to enable this behaviour... musl needs no mods to achieve this!
Simple example:
$ echo 'void main() { puts("executed"); }' >lddtest.c
$ musl-gcc lddtest.c && ldd ./a.out
Of course the exploit is only useable if you check for
LD_TRACE_LOADED_OBJECTS and do something different in the code if it
is set.
Thanks,
Steven.
[1] http://www.catonmat.net/blog/ldd-arbitrary-code-execution/
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
