Date: Mon, 20 Jul 2020 04:21:51 -0400 From: Jeffrey Walton <noloader@...il.com> To: oss-security@...ts.openwall.com Subject: Perl 5.32.0 mishandling of rpath and runpath tokens Hi Everyone, Perl mishandles rpath tokens $ORIGIN, $LIB and $PLATFORM. Also see https://man7.org/linux/man-pages/man8/ld.so.8.html. Building on Linux or Solaris with LDFLAGS that includes a rpath or runpath: -Wl,-R,$ORIGIN/../lib -Wl,-R,$HOME/tmp/ok2delete/lib results in a rpath or runpath similar to below (Solaris is shown): # From $HOME/perl-5.32.0 directory $ elfdump libperl.so | grep PATH  RUNPATH 0xaf4d /../lib:/export/home/jwalton/tmp/ok2delete/lib  RPATH 0xaf4d /../lib:/export/home/jwalton/tmp/ok2delete/lib Now the interesting thing here is, $ORIGIN was expanded to nothing and /../lib is just /lib. And Solaris /lib directory contains old libraries, like zLib 1.2.8 and Bzip 1.0.6. zLib 1.2.8 and Bzip 1.0.6 have CVEs against them. So rather than use the new zLib and Bzip in $HOME/tmp/ok2delete/lib, Perl uses the old ones with CVEs in /lib. Perl stated they won't fix the problem. Also see https://github.com/Perl/perl5/issues/17534. The best workarounds I have found is to run patchelf (Linux) or editelf (Solaris) on all programs and libraries after 'make' and before 'make check', and after 'make check' and before 'make install'. The procedure has to happen twice because Perl rebuilds some things after 'make', including some shared objects built during 'make check'. The problem with the workaround is, patchelf and editelf has limited availability. patchelf is buggy [1,2] and editelf is only available on Solaris 11 .  https://bugzilla.redhat.com/show_bug.cgi?id=1497012  https://bugs.launchpad.net/ubuntu/+source/patchelf/+bug/1888175  https://blogs.oracle.com/solaris/avoiding-ldlibrarypath%3a-the-options-v2
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.