[Bug nptl/19018] New: Mangle function pointers in tls_dtor_list

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=19018

            Bug ID: 19018
           Summary: Mangle function pointers in tls_dtor_list
           Product: glibc
           Version: 2.23
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
          Assignee: fweimer at redhat dot com
          Reporter: fweimer at redhat dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---
             Flags: security-

The tls_dtor_list in stdlib/cxa_thread_atexit_impl.c contains unmangled
function pointers.  It is a particularly attractive target for redirecting
control flow in arbitrary ways because the function is called with a single,
arbitrary argument.  We should at least mangle the function pointer, so that
abusing tls_dtor_list is somewhat more difficult.

(This is purely security hardening.)

-- 
You are receiving this mail because:
You are on the CC list for the bug.