[PATCH v2] debug: Improve '%n' fortify detection (BZ 30932)
Florian Weimer
fweimer@redhat.com
Fri Mar 21 15:41:07 GMT 2025
* Adhemerval Zanella:
> The 7bb8045ec0 path made the '%n' fortify check ignore EMFILE errors
> while trying to open /proc/self/maps, and this added a security
> issue where EMFILE can be attacker-controlled thus making it
> ineffective for some cases.
>
> The EMFILE failure is reinstated but with a different error
> message. Also, to improve the false positive of the hardening for
> the cases where no new files can be opened, the
> _dl_readonly_area now uses _dl_find_object to check if the
> memory area is within a writable ELF segment. The procfs method is
> still used as fallback.
>
> Checked on x86_64-linux-gnu and i686-linux-gnu.
> --
> Changes from v1:
> * Rename readonly-area-arch to readonly-area-fallback.
> * Handle found RW areas on _dl_readonly_area.
> * Use l_relro_addr/l_relro_size in check_relro.
> * Change variable names in tst-sprintf-fortify-rdonly-mod.c.
Adhemerval, are you looking for further comments on this patch?
Thanks,
Florian
More information about the Libc-alpha
mailing list