[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BFD1A25B-1EB8-431B-BDA4-B1A361F1499E@wsu.edu>
Date: Sat, 7 Nov 2026 08:50:51 +0000
From: "Ammanaghatta Shivakumar, Basavesh" <basavesh.shivakumar@....edu>
To: "musl@...ts.openwall.com" <musl@...ts.openwall.com>,
"tg@...bsd.de"
<tg@...bsd.de>
CC: "Priya, Swarn" <swarn.priya@....edu>
Subject: Re: explicit-path `dlopen` does not satisfy later `DT_NEEDED`
by SONAME
I would like to clarify the technical impact of the behavior I reported as you may not care about Cryptographic Constant-Time.
The test program first loads a constant-time provider using an explicit pathname. A plugin loaded afterward has a DT_NEEDED entry matching that provider’s DT_SONAME. musl does not reuse the already-loaded provider under its SONAME, so it follows the plugin’s RUNPATH and loads a second provider with the same SONAME.
In the reproducer, both providers return exactly the same values (functional correctness vs security), so ordinary functional testing does not detect the substitution. However, the second provider uses a secret-indexed table. The output and control-flow traces remain equal, while the effective memory addresses differ consistently between the two secret inputs (cache-based side channel leakage). The glibc control and the musl basename-load control both reuse the original constant-time provider and do not show this difference.
I understand that the underlying SONAME behavior has been discussed previously. The additional point here is that it can silently replace an explicitly selected constant-time implementation with a non-constant-time implementation while preserving all visible outputs.
I hope you consider this report on “technical” importance and not ignore it because “AI’ was used.
- Basavesh
On Nov 7, 2026, at 12:23 AM, Ammanaghatta Shivakumar, Basavesh <basavesh.shivakumar@....edu> wrote:
Fair enough and thanks for letting me know.
LLMs are one tool in my workflow. I reproduce and check every report myself before sending it, and I take responsibility for what’s in it. We have found more than 500 bugs in linkers and loaders so far. It has led to works like https://freenode.net/article/binutils-hardens-18-elf-linkers-against-relaxation-heap-corruption. I can give you bug reports and fixes if you really need to know. These tools sit low in the software supply chain, so I’d like to see these bugs fixed before someone exploits them.
I won’t send LLM-assisted material to this list again.
- Basavesh
On Nov 6, 2026, at 11:41 PM, Thorsten Glaser <tg@...bsd.de> wrote:
[EXTERNAL EMAIL]
On Sat, 7 Nov 2026, Ammanaghatta Shivakumar, Basavesh wrote:
An LLM assisted with reducing the reproducer, checking current source, and
drafting this message.
We could tell. Please don’t send “AI” slop if you want humans to read
it, and to act on it. (Also, please do not use the planet-burning
fashtech machine AT ALL.)
Thanks,
//mirabilos
--
https://urldefense.com/v3/__https://toot.mirbsd.org/@mirabilos/statuses/01KNQD9RNZM1Z2A61AZHG857MP__;!!JmPEgBY0HMszNaDT!vuWoo-gh1LuiA25hCdD-LYKPtbyDcjEZBmBKtP0GXDJou5YgRDyaQp2X7I1pouLY-8HDzVI5PB6l5trPDhJR$
↑ long list of references on why “AI”/LLMs are bad for everyone
also: ↓ from https://urldefense.com/v3/__https://toot.cat/@dthompson/117180306961006760__;!!JmPEgBY0HMszNaDT!vuWoo-gh1LuiA25hCdD-LYKPtbyDcjEZBmBKtP0GXDJou5YgRDyaQp2X7I1pouLY-8HDzVI5PB6l5kMuD35g$
"responsible LLM usage" is the "clean coal" of the tech world
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
