[Bug stdio/25812] New: Libio vtable protection is sometimes only partially enforced

["maxkamper at outlook dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=25812

            Bug ID: 25812
           Summary: Libio vtable protection is sometimes only partially
                    enforced
           Product: glibc
           Version: 2.31
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: stdio
          Assignee: unassigned at sourceware dot org
          Reporter: maxkamper at outlook dot com
  Target Milestone: ---

Some versions of GLIBC bundled with popular distros still place their libio
vtables in a writable segment. E.g. Ubuntu 1904 (which uses GLIBC 2.29)
exhibits this behaviour, whilst the earlier Ubuntu 1804 (which uses GLIBC 2.27)
does not.

This could be a choice on behalf of the distro maintainers but it seems
unlikely.

Vtable pointers are still checked before dereferencing but I feel this is
undermined somewhat by the fact that the vtables themselves are mapped
writable.

Perhaps the issue is in the Makerules file, around line 549, which is commented
"If the linker is good enough, we can let it use its default linker script."
The issue seems to manifest depending on the preceding ifeq statement's result.

I'm not well versed enough in the workings of linkers to comment as to why this
might be, but I've experienced the same writable vtable issue whilst building
GLIBC using more recent versions of GCC.

-- 
You are receiving this mail because:
You are on the CC list for the bug.