[PATCH v3 00/32] RELRO linkmaps

[Florian Weimer]

* Adhemerval Zanella Netto:

> On 11/03/24 14:24, Florian Weimer wrote:
>> * Adhemerval Zanella Netto:
>> 
>>> On 07/12/23 07:56, Florian Weimer wrote:
>>>> * Andreas Schwab:
>>>>
>>>>> Can you please provide a summary?
>>>>
>>>> The original cover letter is quite elaborate:
>>>>
>>>>   <https://inbox.sourceware.org/libc-alpha/cover.1688499219.git.fweimer@redhat.com/>
>>>>
>>>> Please let me know if you need something else.
>>>
>>> Also could you describe with more details the possible attack that targets
>>> l_info[DT_FINI] and l_infi[DT_FINI_ARRAY]?  I would like to understand
>>> better the attack vector mainly because this patchset re-adds a potential
>>> startup failure (the _dl_protmem_bootstrap) now that we just removed it
>>> from tunable initialization.
>> 
>> I think this has some details:
>> 
>>   Nightmare: One Byte to ROP // Alternate Solution
>>   <https://github.com/LMS57/Nightmare-Writeup>
>> 
>> I'm not sure if the first write-up that was shared with me is public.
>
> But how feasible is this attack in real work case? Reading through the
> report, it requires some access no only to the binary, but to the
> runtime as well to brute force the addresses, and it also seems to
> rely on lazy resolution. With this reports, it does not indicate 
> how useful is this kind of attack without adding a lot of priors.

There are other write-ups now, for example:

  Code execution with a write primitive on last libc.
  (a.k.a. Six Different Ways)
  <https://github.com/nobodyisnobody/docs/blob/main/code.execution.on.last.libc/README.md#2---targetting-ldso-link_map-structure>

Thanks,
Florian