oss-sec mailing list archives
glibc $ORIGIN problem - CVE-2010-3847
From: Marcus Meissner <meissner () suse de>
Date: Thu, 21 Oct 2010 10:06:45 +0200
Hi, The actually exploitable impact of Tavis glibc $ORIGIN problem is still a bit open question. Apparently the bad code has a assert() in front which causes this assertion failure: $ LD_AUDIT=\$ORIGIN ping Inconsistency detected by ld.so: dl-open.c: 231: dl_open_worker: Assertion `(call_map)->l_name[0] == '\0'' failed! $ If glibc was built with -DNDEBUG the assert() is empty and the code will proceed into the exploitable parts. Sebastian Krahmer of my team looked at this yesterday and was quite confident that the problematic zone is protected by this assert(). The source code is however quite a labyrinth of c files, headers and macros so we might have missed something. Andreas Schwab of Redhat has posted candidate patches to fix the problems: http://sourceware.org/ml/libc-hacker/2010-10/msg00007.html http://sourceware.org/ml/libc-hacker/2010-10/msg00008.html Ciao, Marcus
Current thread:
- glibc $ORIGIN problem - CVE-2010-3847 Marcus Meissner (Oct 21)
- Re: glibc $ORIGIN problem - CVE-2010-3847 Robert Święcki (Oct 21)
- Re: glibc $ORIGIN problem - CVE-2010-3847 Florian Weimer (Oct 22)
- Re: glibc $ORIGIN problem - CVE-2010-3847 Solar Designer (Oct 24)
- Re: glibc $ORIGIN problem - CVE-2010-3847 Dmitry V. Levin (Oct 26)
- Re: glibc $ORIGIN problem - CVE-2010-3847 Solar Designer (Oct 24)