[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <E98836FE-9F2F-4D02-BE84-FFC22DC1E52C@davidberard.fr>
Date: Tue, 1 Dec 2009 13:39:31 +0100
From: David Berard <contact@...idberard.fr>
To: full-disclosure@...ts.grok.org.uk
Cc: Colin Percival <cperciva@...ebsd.org>
Subject: Re: ** FreeBSD local r00t zeroday
> The patch is at
> http://people.freebsd.org/~cperciva/rtld.patch
>
This patch doesn't work under FreeBSD 7.x due to inexistant
unsetenv(LD_ "ELF_HINTS_PATH"); in rtld.c
This patch seem to fix the issue on FreeBSD 7.x
--- /usr/src/libexec/rtld-elf/rtld.c 2008-11-25 03:59:29.000000000 +0100
+++ /usr/src/libexec/rtld-elf/rtld.c.new 2009-12-01 13:09:15.000000000 +0100
@@ -358,11 +358,12 @@
* future processes to honor the potentially un-safe variables.
*/
if (!trust) {
- unsetenv(LD_ "PRELOAD");
- unsetenv(LD_ "LIBMAP");
- unsetenv(LD_ "LIBRARY_PATH");
- unsetenv(LD_ "LIBMAP_DISABLE");
- unsetenv(LD_ "DEBUG");
+ if (unsetenv(LD_ "PRELOAD") || unsetenv(LD_ "LIBMAP") ||
+ unsetenv(LD_ "LIBRARY_PATH") || unsetenv(LD_ "LIBMAP_DISABLE") ||
+ unsetenv(LD_ "DEBUG")) {
+ _rtld_error("environment corrupt; aborting");
+ die();
+ }
}
ld_debug = getenv(LD_ "DEBUG");
libmap_disable = getenv(LD_ "LIBMAP_DISABLE") != NULL;
Best Regards.
--
David BERARD
-------------------------------------------------
23 Boulevard MARENGO, Appartement A15
31500 TOULOUSE
contact(at)davidberard.fr
GPG|PGP KeyId 0xC8533354
GPG|PGP Key http://davidberard.fr/C8533354.gpgkey
-------------------------------------------------
* No electrons were harmed in *
* the transmission of this email *
Download attachment "PGP.sig" of type "application/pgp-signature" (164 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists