Glibc Dynamic Loader Hit by a Nasty Local Privilege Escalation Vulnerability

Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by aleden on Tuesday October 03, 2023 @06:48PM (#37758640)

The GLIBC_TUNABLES can be used to "choose" between different versions of e.g. memcpy at runtime. This can be really useful for debugging, if you want to allow/disallow AVX extensions, for example (even if your CPU supports them). This is what I use on x86_64 to make life easier for my "static" version of qemu usermode:

  GLIBC_TUNABLES=glibc.cpu.hwcaps=
              -AVX
              -AVX2
              -AVX_Usable
              -AVX2_Usable
              -AVX512F_Usable
              -SSE4_1
              -SSE4_2
              -SSSE3
              -Fast_Unaligned_Load
              -ERMS
              -AVX_Fast_Unaligned_Load

[ Parent | on HN ]

Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by remexre on Tuesday October 03, 2023 @07:59PM (#37759165)

Does removing ERMS actually make life easier? I thought it was the "do the simple thing" option, and an emulator could just turn it into a memcpy on the emulator's side.

[ Parent | on HN ]

Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by saagarjha on Tuesday October 03, 2023 @08:54PM (#37759615)

rep movsb has stronger requirements than memcpy, in particular with regards to behavior when the source and destination overlap.

[ Parent | on HN ]

Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by remram on Wednesday October 04, 2023 @08:44PM (#37773612)

Sounds like a DoS vector at least, even if the filter worked correctly. Why should you be able to disable AVX extensions for another user's process? Why would you debug across SUID boundaries?

[ Parent | on HN ]