security policy about LD_PRELOAD and /etc/ld.so.preloadload

From	慕冬亮 <mudongliangabcd@hotmail.com>
Newsgroups	linux.debian.security
Subject	security policy about LD_PRELOAD and /etc/ld.so.preloadload
Date	2015-07-30 04:40 +0200
Message-ID	<pRLVg-1Lu-3@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

I have a security problem about LD_PRELOAD and /etc/ld.so.preload.
Recently I see the bug of CVE-2015-1328 in Ubuntu series (http://cxsecurity.com/issue/WLB-2015060081),
the attack method is using the bug of overlayfs to create ld.so.preload in the /etc.
He writes his getuid function to overlap the original function, then he can bypass su authentication.

But if I use the LD_PRELOAD  on Ubuntu, the result shows me ,"LD_PRELOAD is ignored".

When I create the /etc/ld.so.preload by myself, and using the getuid function of the author in Debian Jessie,
the result shows me , "/etc/ld.so.preload is ignored".

I want to know the security policy about LD_PRELOAD and /etc/ld.so.preload in Debian.
Thanks.
    - mudongliang

Back to linux.debian.security | Previous | Next | Find similar | Unroll thread

Thread

security policy about LD_PRELOAD and /etc/ld.so.preloadload 慕冬亮 <mudongliangabcd@hotmail.com> - 2015-07-30 04:40 +0200

csiph-web