3 ms·

While you are technically correct, ldd is literally a bash script which runs ld-linux.so...

• throwaway09223 5y ago
  ld-linux.so's job is to link and run an executable. It's not a vulnerability that it runs executable it's been handed. If you run "ld-linux.so /bin/ls" you're just running "ls" There's no security issue with this behavior. It's an interpreter like any other - same as /usr/bin/python. The argument around ldd having a vulnerability is that it appears to be an introspective tool. It is not immediately obvious that it just executes "LD_TRACE_LOADED_OBJECTS=1 ld-linux.so /bin/ls" to print what the linker does during an actual, live linking operation. ldd documenting this fact to remind people seems reasonable to me. There are other tools like readelf which can inspect objects without executing their contents. Dynamic linking is, well, dynamic and it can depend on code executed at runtime -- so it is necessary to do so to get an accurate report of what will happen.