Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ubuntu 22.04 breaks glibc-provided features #66

Open
noproto opened this issue Sep 4, 2022 · 0 comments
Open

Ubuntu 22.04 breaks glibc-provided features #66

noproto opened this issue Sep 4, 2022 · 0 comments
Labels
bug Something isn't working

Comments

@noproto
Copy link
Collaborator

noproto commented Sep 4, 2022

Ubuntu 22.04 patched ld.so with local-disable-ld_audit.diff, a patch that offers:

  • No security benefits - what it is aiming to prevent is already offered by other components of glibc making it trivial to bypass, and the patch itself relies on invalid assumptions about current glibc security countermeasures in an effort to mitigate a decade-old (patched) security vulnerability
  • Breaks glibc-provided features - patch mentions that it is unlikely to be merged upstream due to breaking changes limiting the auditing features of the linker
  • No configuration options - breaks LD_AUDIT fundamentally including recent (2020) binary flags that would be otherwise unaffected if the patch was better designed

Despite this unfortunate change, there are two paths forward:

  • Offer WhiteBeam repositories that provide a patched libc6 package on Ubuntu 22.04, which is helpful for out of date ARM systems regardless (all Ubuntu versions prior to 22.04 ship with < glibc 2.35 which has audit fixes and v2 of the API)
  • Inform Ubuntu developers that one of the 9 patches of glibc causes breaking changes and to revert it, or to add configuration options to not fundamentally break LD_AUDIT for SUID binaries
@WhiteBeamSec WhiteBeamSec deleted a comment from klikevil Sep 5, 2022
@noproto noproto added the bug Something isn't working label Oct 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant