[RFC] libio FILE/vtable hardening ideas against FSOP-style attacks

[Paul Eggert]

Thanks for your email. Although I'm by no means an expert in that 
particular area, here's my kneejerk reaction for what it's worth.

On 2026-06-22 03:42, 류대호 wrote:
> Does validating the wide vtable path with IO_validate_vtable 
> seem like a reasonable hardening direction?

Given that we also validate the primary vtable path, validating the wide 
vtable path sounds like a good idea that would fix a real security 
issue. I suggest writing up a patchset to address this issue. I assume 
there would be zero overhead in the typical (non-wide) case.


> Is exact vtable start- 
> address checking too strict for glibc, or could it be useful in some 
> limited paths? Is a FILE metadata registry fundamentally incompatible 
> with libio, or is it worth exploring as an optional hardening idea?

My guess is that these would cost too much validation overhead (and be 
of too little practical effect) to be acceptable in ordinary use. Maybe 
as an option, though we should get more-expert advice on that.

If you go ahead with a patch, we'll also need copyright papers signed to 
satisfy legal requirements before we can accept it. But you should 
probably wait a bit first, to see what others think about this idea.