[Bug dynamic-link/33797] elf: Out-of-bounds write in ld.so profiling via unvalidated self_pc

[carlos at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=33797

--- Comment #5 from Carlos O'Donell <carlos at redhat dot com> ---
(In reply to Florian Weimer from comment #4)
> (In reply to Carlos O'Donell from comment #3)
> > (In reply to Florian Weimer from comment #2)
> > > I think it's rather problematic that /var/tmp is used as the default here.
> > > This is a 1777 directory, and I don't think we can treat file contents as
> > > trusted there.
> > > 
> > > We should remove the default directory, I think.
> > 
> > I agree that it's problematic, but it wasn't sufficient for the glibc
> > security team to consider this issue as having security impact.
> 
> Why isn't it possible that the impacted code opens an attacker-controlled
> file under /var/tmp?

It is possible, and you shouldn't do that.

You should not use this feature with untrusted data.

-- 
You are receiving this mail because:
You are on the CC list for the bug.