News for hackers. Stuff that matters.

A comment on Glibc Dynamic Loader Hit by a Nasty Local Privilege Escalation Vulnerability. Parent comment

Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by worthless-trash on Tuesday October 03, 2023 @10:00PM (#37759995)
Last time i looked, the musl library allocator was also exploitable by similar style 'house of' attacks. Maybe its been fixed now. I dont know if you can make a judgement call that musl is better because it has 'less code' when its still open to exploit mechanisms that glibc fixed many moons ago.
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by CyberDildonics on Wednesday October 04, 2023 @07:47PM (#37773230)
the musl library allocator was also exploitable by similar style 'house of' attacks

What are you basing this on? Can you demonstrate how this works?

[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by worthless-trash on Thursday October 05, 2023 @03:28AM (#37775768)
Not in a HN news comment, I don't have that level of dedication to this because its definitely non trivial. However you can read about them in use against the glibc allocator are here: https://github.com/DhavalKapil/heap-exploitation/blob/master...

The "house of" attack method are attacks against the allocator, its been a while since I've looked into it, I hope musl have hardened their allocator against this kind of attacks.

[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by CyberDildonics on Thursday October 05, 2023 @10:31AM (#37779094)
The link you have here is 'attacking' by directly changing the meta data in C with pointer offsets and doesn't mention musl anywhere.
[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by worthless-trash on Thursday October 05, 2023 @11:09AM (#37779600)
I did not say that it did. I'm saying that I believe the same kind of attacks work against the musl allocator, or at least I think they did at that time.

Musl was not being used by the business I worked in, therefore I had no interest in continuing investigation other than trying to get an understanding of how other implementations dealt with it.

I'm sorry for any confusion.

[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by CyberDildonics on Thursday October 05, 2023 @01:50PM (#37781685)
I believe the same kind of attacks work against the musl allocator

Why is this even an attack and why would musl have whatever weakness is claimed here?

[ Parent | on HN ]
Re:Glibc Dynamic Loader Hit by a Nasty Local Privilege Escal... by worthless-trash on Friday October 06, 2023 @08:28AM (#37789829)
Gotcha.
[ Parent | on HN ]