Re: My dynamic loader refuses to load libQt5Core because of the ABI tag note

[Adhemerval Zanella <adhemerval.zanella@linaro.org>]

On 07/10/2021 16:00, Carlos O'Donell via Libc-help wrote:
> On 10/7/21 14:53, Jeffrey Walton via Libc-help wrote:
>> On Thu, Oct 7, 2021 at 2:47 PM Krzysztof Żelechowski via Libc-help
>> <libc-help@sourceware.org> wrote:
>>>
>>> /usr/lib/YaST2/bin/y2controlcenter
>>>                 /usr/lib/YaST2/bin/y2controlcenter: error while loading shared libraries: libQt5Core.so.5: cannot open shared object file: No such file or directory
>>> uname -r
>>>                 4.4.0-19041-Microsoft
>>> ldd /usr/lib64/libQt5Widgets.so.5
>>> libQt5Core.so.5 => not found
>>> /usr/lib64/libQt5Core.so.5
>>>                 This is the QtCore library version Qt 5.12.7 (x86_64-little_endian-lp64 shared (dynamic) release build; by GCC 7.5.0)
>>> Copyright (C) 2016 The Qt Company Ltd.
>>> Contact: http://www.qt.io/licensing/
>>>
>>> Installation prefix: /usr
>>> Library path:        lib64
>>> Include path:        include/qt5
>>> Processor features:  sse2[required] sse3 ssse3 fma sse4.1 sse4.2 movbe popcnt aes avx f16c rdrnd bmi avx2 bmi2 rdseed sha
>>> readelf -n /usr/lib64/libQt5Core.so.5
>>> Displaying notes found in: .note.ABI-tag
>>>   Owner                Data size        Description
>>>   GNU                  0x00000010       NT_GNU_ABI_TAG (ABI version tag)
>>>     OS: Linux, ABI: 3.17.0
>>> objcopy -R .note.ABI-tag /usr/lib64/libQt5Core.so.5 /tmp/libQt5Core.so.5
>>> LD_LIBRARY_PATH=/tmp /usr/lib/YaST2/bin/y2controlcenter
>>
>> Off-topic, this is probably CVE worthy:
>>
>>     LD_LIBRARY_PATH=/tmp
> 
> Why is this CVE worthy?
> 
> The user copied a library to /tmp, stripping a section, and then restarted the binary
> with an LD_LIBRARY_PATH to use the temporary copy of the library with the changes.
> 
> LD_LIBRARY_PATH is used *after* DT_RPATH (if DT_RUNPATH is not present), and so has
> precedence as expected, and is controlled by the user.
> 

And there is some discussion whether is up to glibc to deny preload
of file with NOEXEC mounts [1] (if it is what you might be referring).

[1] https://sourceware.org/pipermail/libc-alpha/2021-August/130403.html