full-disclosure - Re: ** FreeBSD local r00t zeroday

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 1 Dec 2009 13:39:31 +0100
From: David Berard <contact@...idberard.fr>
To: full-disclosure@...ts.grok.org.uk
Cc: Colin Percival <cperciva@...ebsd.org>
Subject: Re: ** FreeBSD local r00t zeroday

> The patch is at
>  http://people.freebsd.org/~cperciva/rtld.patch
> 

This patch doesn't work under FreeBSD 7.x due to inexistant 
unsetenv(LD_ "ELF_HINTS_PATH"); in rtld.c


This patch seem to fix the issue on FreeBSD 7.x

--- /usr/src/libexec/rtld-elf/rtld.c	2008-11-25 03:59:29.000000000 +0100
+++ /usr/src/libexec/rtld-elf/rtld.c.new	2009-12-01 13:09:15.000000000 +0100
@@ -358,11 +358,12 @@
      * future processes to honor the potentially un-safe variables.
      */
     if (!trust) {
-        unsetenv(LD_ "PRELOAD");
-        unsetenv(LD_ "LIBMAP");
-        unsetenv(LD_ "LIBRARY_PATH");
-        unsetenv(LD_ "LIBMAP_DISABLE");
-        unsetenv(LD_ "DEBUG");
+	    if (unsetenv(LD_ "PRELOAD") || unsetenv(LD_ "LIBMAP") ||
+			    unsetenv(LD_ "LIBRARY_PATH") || unsetenv(LD_ "LIBMAP_DISABLE") ||
+			    unsetenv(LD_ "DEBUG")) {
+		    _rtld_error("environment corrupt; aborting");
+		    die();
+	    }
     }
     ld_debug = getenv(LD_ "DEBUG");
     libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL;

Best Regards.

--
David BERARD
-------------------------------------------------
23 Boulevard MARENGO, Appartement A15
31500 TOULOUSE
contact(at)davidberard.fr
GPG|PGP KeyId 0xC8533354
GPG|PGP Key http://davidberard.fr/C8533354.gpgkey
-------------------------------------------------
*          No electrons were harmed in          *
*         the transmission of this email        *


Download attachment "PGP.sig" of type "application/pgp-signature" (164 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/