2 ms·
If an attacker can fully control the name of an injected environment variable, then you've lost already. The attacker can override LD_PRELOAD, which is an envir
by AgentME 12y ago
If an attacker can fully control the name of an injected environment variable, then you've lost already. The attacker can override LD_PRELOAD, which is an environment variable honored by the Linux kernel itself.
- thyrsus 12y agoLD_PRELOAD is not honored for setuid executables, but you're right, we don't want to go there.