public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced
@ 2020-04-10 17:22 maxkamper at outlook dot com
2020-04-15 7:09 ` [Bug stdio/25812] " luciham20 at gmail dot com
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: maxkamper at outlook dot com @ 2020-04-10 17:22 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=25812
Bug ID: 25812
Summary: Libio vtable protection is sometimes only partially
enforced
Product: glibc
Version: 2.31
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: stdio
Assignee: unassigned at sourceware dot org
Reporter: maxkamper at outlook dot com
Target Milestone: ---
Some versions of GLIBC bundled with popular distros still place their libio
vtables in a writable segment. E.g. Ubuntu 1904 (which uses GLIBC 2.29)
exhibits this behaviour, whilst the earlier Ubuntu 1804 (which uses GLIBC 2.27)
does not.
This could be a choice on behalf of the distro maintainers but it seems
unlikely.
Vtable pointers are still checked before dereferencing but I feel this is
undermined somewhat by the fact that the vtables themselves are mapped
writable.
Perhaps the issue is in the Makerules file, around line 549, which is commented
"If the linker is good enough, we can let it use its default linker script."
The issue seems to manifest depending on the preceding ifeq statement's result.
I'm not well versed enough in the workings of linkers to comment as to why this
might be, but I've experienced the same writable vtable issue whilst building
GLIBC using more recent versions of GCC.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug stdio/25812] Libio vtable protection is sometimes only partially enforced
2020-04-10 17:22 [Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced maxkamper at outlook dot com
@ 2020-04-15 7:09 ` luciham20 at gmail dot com
2020-04-15 7:11 ` luciham20 at gmail dot com
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: luciham20 at gmail dot com @ 2020-04-15 7:09 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=25812
Lucille F. Parham <luciham20 at gmail dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |luciham20 at gmail dot com
--- Comment #1 from Lucille F. Parham <luciham20 at gmail dot com> ---
This is a really interesting and informative post. Good job ! keep it up, hope
to read your other updates.
https://www.reddit.com/r/AndroidtoPCandMac/comments/f79k3w/how_to_easily_play_subway_surfers_in_pc/
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug stdio/25812] Libio vtable protection is sometimes only partially enforced
2020-04-10 17:22 [Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced maxkamper at outlook dot com
2020-04-15 7:09 ` [Bug stdio/25812] " luciham20 at gmail dot com
@ 2020-04-15 7:11 ` luciham20 at gmail dot com
2021-09-30 13:57 ` fweimer at redhat dot com
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: luciham20 at gmail dot com @ 2020-04-15 7:11 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=25812
--- Comment #2 from Lucille F. Parham <luciham20 at gmail dot com> ---
This is a really interesting and informative post. Good job ! keep it up, hope
to read your other updates.
https://www.reddit.com/r/AndroidtoPCandMac/comments/f79k3w/how_to_easily_play_subway_surfers_in_pc/
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug stdio/25812] Libio vtable protection is sometimes only partially enforced
2020-04-10 17:22 [Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced maxkamper at outlook dot com
2020-04-15 7:09 ` [Bug stdio/25812] " luciham20 at gmail dot com
2020-04-15 7:11 ` luciham20 at gmail dot com
@ 2021-09-30 13:57 ` fweimer at redhat dot com
2022-04-11 9:17 ` fweimer at redhat dot com
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: fweimer at redhat dot com @ 2021-09-30 13:57 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=25812
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |fweimer at redhat dot com
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug stdio/25812] Libio vtable protection is sometimes only partially enforced
2020-04-10 17:22 [Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced maxkamper at outlook dot com
` (2 preceding siblings ...)
2021-09-30 13:57 ` fweimer at redhat dot com
@ 2022-04-11 9:17 ` fweimer at redhat dot com
2022-04-12 11:27 ` fweimer at redhat dot com
2022-04-22 10:31 ` fweimer at redhat dot com
5 siblings, 0 replies; 7+ messages in thread
From: fweimer at redhat dot com @ 2022-04-11 9:17 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=25812
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Last reconfirmed| |2022-04-11
Status|UNCONFIRMED |ASSIGNED
Assignee|unassigned at sourceware dot org |fweimer at redhat dot com
Ever confirmed|0 |1
--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
I'm actively working on this.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug stdio/25812] Libio vtable protection is sometimes only partially enforced
2020-04-10 17:22 [Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced maxkamper at outlook dot com
` (3 preceding siblings ...)
2022-04-11 9:17 ` fweimer at redhat dot com
@ 2022-04-12 11:27 ` fweimer at redhat dot com
2022-04-22 10:31 ` fweimer at redhat dot com
5 siblings, 0 replies; 7+ messages in thread
From: fweimer at redhat dot com @ 2022-04-12 11:27 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=25812
--- Comment #4 from Florian Weimer <fweimer at redhat dot com> ---
Patch with test case posted:
https://sourceware.org/pipermail/libc-alpha/2022-April/137700.html
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Bug stdio/25812] Libio vtable protection is sometimes only partially enforced
2020-04-10 17:22 [Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced maxkamper at outlook dot com
` (4 preceding siblings ...)
2022-04-12 11:27 ` fweimer at redhat dot com
@ 2022-04-22 10:31 ` fweimer at redhat dot com
5 siblings, 0 replies; 7+ messages in thread
From: fweimer at redhat dot com @ 2022-04-22 10:31 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=25812
Florian Weimer <fweimer at redhat dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |security-
Target Milestone|--- |2.36
Resolution|--- |FIXED
Status|ASSIGNED |RESOLVED
--- Comment #5 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for glibc 2.36 via:
commit 198abcbb94618730dae1b3f4393efaa49e0ec8c7
Author: Florian Weimer <fweimer@redhat.com>
Date: Mon Apr 11 11:30:31 2022 +0200
Default to --with-default-link=no (bug 25812)
This is necessary to place the libio vtables into the RELRO segment.
New tests elf/tst-relro-ldso and elf/tst-relro-libc are added to
verify that this is what actually happens.
The new tests fail on ia64 due to lack of (default) RELRO support
inbutils, so they are XFAILed there.
I'm flagging this as security- because it is just a lack of intended hardening,
but not a vulnerability as such.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-04-22 10:31 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-10 17:22 [Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced maxkamper at outlook dot com
2020-04-15 7:09 ` [Bug stdio/25812] " luciham20 at gmail dot com
2020-04-15 7:11 ` luciham20 at gmail dot com
2021-09-30 13:57 ` fweimer at redhat dot com
2022-04-11 9:17 ` fweimer at redhat dot com
2022-04-12 11:27 ` fweimer at redhat dot com
2022-04-22 10:31 ` fweimer at redhat dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).