diff options
| author | Florian Weimer <fweimer@redhat.com> | 2018-02-21 10:37:22 +0100 |
|---|---|---|
| committer | Florian Weimer <fweimer@redhat.com> | 2018-02-21 10:37:22 +0100 |
| commit | 52a01100ad011293197637e42b5be1a479a2f4ae (patch) | |
| tree | 8bfbd570b7eda10ee7de5fcb8ce430c1043af0f0 /ChangeLog | |
| parent | b5bf62e40c5ff4e3906572f257dcda77b393ffa0 (diff) | |
| download | glibc-52a01100ad011293197637e42b5be1a479a2f4ae.tar.gz glibc-52a01100ad011293197637e42b5be1a479a2f4ae.tar.xz glibc-52a01100ad011293197637e42b5be1a479a2f4ae.zip | |
elf: Remove ad-hoc restrictions on dlopen callers [BZ #22787]
This looks like a post-exploitation hardening measure: If an attacker is able to redirect execution flow, they could use that to load a DSO which contains additional code (or perhaps make the stack executable). However, the checks are not in the correct place to be effective: If they are performed before the critical operation, an attacker with sufficient control over execution flow could simply jump directly to the code which performs the operation, bypassing the check. The check would have to be executed unconditionally after the operation and terminate the process in case a caller violation was detected. Furthermore, in _dl_check_caller, there was a fallback reading global writable data (GL(dl_rtld_map).l_map_start and GL(dl_rtld_map).l_text_end), which could conceivably be targeted by an attacker to disable the check, too. Other critical functions (such as system) remain completely unprotected, so the value of these additional checks does not appear that large. Therefore this commit removes this functionality.
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index b4e1f34818..a56f1fa0ff 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,24 @@ +2018-02-21 Florian Weimer <fweimer@redhat.com> + + [BZ #22787] + * include/caller.h: Remove file. + * elf/dl-caller.c: Likewise. + * elf/Makefile (dl-routines): Remove dl-caller. + (shared-only-routines): Do not add dl-caller. + * elf/dl-load.c (_dl_map_object_from_fd): Do not call + __check_caller. + * elf/dl-open.c (struct dl_open_args): Remove caller_dl_open + member. + (dl_open_worker): Do not call __check_caller. + (_dl_open): Do not set caller_dl_open member. + * elf/rtld.c (_rtld_global_ro): Do not initialize + _dl_check_caller member. + * sysdeps/generic/ldsodefs.h (rtld_global): Remove + _dl_check_caller member. + (_dl_check_caller): Remove declaration. + * sysdeps/unix/sysv/linux/dl-execstack.c + (_dl_make_stack_executable): Do not call __check_caller. + 2018-02-21 Samuel Thibault <samuel.thibault@ens-lyon.org> * sysdeps/mach/hurd/dl-sysdep.c (_dl_random): New variable. |