3 ms·

systemd merged a change to using dlopen for compression libraries recently https://github.com/systemd/systemd/pull/31550 https://github.com/systemd/systemd/pull

systemd merged a change to using dlopen for compression libraries recently https://github.com/systemd/systemd/pull/31550 https://github.com/systemd/systemd/pull/31550 which is a safer linking method in that sense.

nextaccountic 3y ago
Why is it safer?
- jcranmer 3y ago
  It means the libraries are only loaded when they are needed, so if you never use the (e.g.) xz compression feature, the xz library will not be loaded, and a backdoor added in the xz library simply can't trigger. (Another side note is this may change the initialization order of libraries--so the initialization functions of an xz library don't run until xz is first used, and this may fail to let you intercept the ssh routines in time.)
  - account42 3y ago
    > this may fail to let you intercept the ssh routines in time It only makes it harder since you can always patch the code of the entire process at runtime (remapping things writable as needed).
- kzrdude 3y ago
  I won't pretend I understand it all, but apart from linking only when needed, some explanations have come out how it would have prevented this exploit path. From https://research.swtch.com/xz-script https://research.swtch.com/xz-script > The effect of the scripts is to arrange for the nefarious object file’s _get_cpuid function to be called as part of a GNU indirect function (ifunc) resolver. In general these resolvers can be called lazily at any time during program execution, but for security reasons it has become popular to call all of them during dynamic linking (very early in program startup) and then map the global offset table (GOT) and procedure linkage table (PLT) read-only, to keep buffer overflows and the like from being able to edit it. But a nefarious ifunc resolver would run early enough to be able to edit those tables, and that’s exactly what the backdoor introduced. This early execution would not be possible if liblzma was dlopened later.
edflsafoiewq 3y ago
This hides the dependencies from ldd doesn't it?
- kzrdude 3y ago
  Yes, but there was some way to put them back my elf metadata
  - edflsafoiewq 3y ago
    How?
    - kzrdude 3y ago
      I looked at this again and I think it implies that there /would/ be a way but it's not really standardized how to do it yet? https://github.com/systemd/systemd/pull/31131#issuecomment-1917618062 https://github.com/systemd/systemd/pull/31131#issuecomment-1...

nextaccountic 3y ago

Why is it safer?

jcranmer 3y ago
It means the libraries are only loaded when they are needed, so if you never use the (e.g.) xz compression feature, the xz library will not be loaded, and a backdoor added in the xz library simply can't trigger. (Another side note is this may change the initialization order of libraries--so the initialization functions of an xz library don't run until xz is first used, and this may fail to let you intercept the ssh routines in time.)
- account42 3y ago
  > this may fail to let you intercept the ssh routines in time It only makes it harder since you can always patch the code of the entire process at runtime (remapping things writable as needed).
kzrdude 3y ago
I won't pretend I understand it all, but apart from linking only when needed, some explanations have come out how it would have prevented this exploit path. From https://research.swtch.com/xz-script https://research.swtch.com/xz-script > The effect of the scripts is to arrange for the nefarious object file’s _get_cpuid function to be called as part of a GNU indirect function (ifunc) resolver. In general these resolvers can be called lazily at any time during program execution, but for security reasons it has become popular to call all of them during dynamic linking (very early in program startup) and then map the global offset table (GOT) and procedure linkage table (PLT) read-only, to keep buffer overflows and the like from being able to edit it. But a nefarious ifunc resolver would run early enough to be able to edit those tables, and that’s exactly what the backdoor introduced. This early execution would not be possible if liblzma was dlopened later.

edflsafoiewq 3y ago

This hides the dependencies from ldd doesn't it?

kzrdude 3y ago
Yes, but there was some way to put them back my elf metadata
- edflsafoiewq 3y ago
  How?
  - kzrdude 3y ago
    I looked at this again and I think it implies that there /would/ be a way but it's not really standardized how to do it yet? https://github.com/systemd/systemd/pull/31131#issuecomment-1917618062 https://github.com/systemd/systemd/pull/31131#issuecomment-1...