Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 21 Oct 2010 10:06:45 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: glibc $ORIGIN problem - CVE-2010-3847

Hi,

The actually exploitable impact of Tavis glibc $ORIGIN problem is still a bit open question.

Apparently the bad code has a assert() in front which causes this assertion failure:

$ LD_AUDIT=\$ORIGIN ping
Inconsistency detected by ld.so: dl-open.c: 231: dl_open_worker: Assertion `(call_map)->l_name[0] == '\0'' failed!
$ 

If glibc was built with -DNDEBUG the assert() is empty and the code will proceed
into the exploitable parts.

Sebastian Krahmer of my team looked at this yesterday and was quite confident
that the problematic zone is protected by this assert(). The source code is however
quite a labyrinth of c files, headers and macros so we might have missed something.

Andreas Schwab of Redhat has posted candidate patches to fix the problems:
	http://sourceware.org/ml/libc-hacker/2010-10/msg00007.html
	http://sourceware.org/ml/libc-hacker/2010-10/msg00008.html

Ciao, Marcus

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.