3 ms·

Does this copy that unexpected behavior where ldd will actually execute some libraries it's interrogating? https://catonmat.net/ldd-arbitrary-code-execution ht

• jcul 2y ago
  From a quick scan of the code, on mobile, it doesn't look like it does. This seems to actually manually parse the ELF file and recursively parse any dependencies. Pretty cool.
• mid-kid 2y ago
  Recent (like 5+ years) versions of "ldd" will not invoke the target binary either. See: https://manpages.debian.org/unstable/manpages/ldd.1.en.html#Security https://manpages.debian.org/unstable/manpages/ldd.1.en.html#...
  • nextaccountic 2y ago
    Does this mean that ldd is secure by default now?
• zem 2y ago
  I wrote something vaguely similar for python and we could never get around that issue https://github.com/google/importlab/issues/69 https://github.com/google/importlab/issues/69
• blueflow 2y ago
  Or use objdump, which prints the data as it is encoded in the ELF file. Including the list of libraries the vdso will search for.