4 ms·
> (...) the backdoor adds an audit hook. The dynamic linker calls all the registered audit hooks when it is resolving a symbol. How was this possible without a
by somemisopaste 2y ago
> (...) the backdoor adds an audit hook. The dynamic linker calls all the registered audit hooks when it is resolving a symbol.
How was this possible without also modifying the LD_AUDIT var? Haven't seen that mentioned yet, or perhaps I'm missing something.
- rwmj 2y agoWhen you're running inside the binary you can do mostly whatever you want. Especially in this case where the back door could run before mprotect(2) has been used to write-protect critical structures like the GOT and PLT (not that that is watertight either).
- tgv 2y agoI guess this is the answer (from https://sourceware.org/glibc/wiki/GNU_IFUNC https://sourceware.org/glibc/wiki/GNU_IFUNC): > Symbols of type STT_GNU_IFUNC (GNU-specific extension) are treated differently from normal symbols. Such IFUNC symbols point to the resolver function, and all calls to such functions are delayed until runtime.
- nwellnhof 2y agoIt's probably as easy as modifying "extern struct rtld_global_ro _rtld_global_ro", exported from ld-linux, the dynamic linker/loader. During IFUNC resolution this struct seems to be writable.
- somemisopaste 2y agoSo in other words LD_AUDIT is useless? If it's that easy to overwrite the GOT I fail to see the purpose in audit functionality.