glibc: pointer guard circumvention
| Package(s): | glibc | CVE #(s): | CVE-2015-8777 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | December 24, 2015 | Updated: | January 20, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE bugzilla entry:
A weakness in the dynamic loader have been found, Glibc prior to 2.22.90 are affected. The issue is that the LD_POINTER_GUARD in the environment is not sanitized allowing local attackers easily to bypass the pointer guarding protection on set-user-ID and set-group-ID programs. Details and PoC at: http://hmarco.org/bugs/glibc_ptr_mangle_weakness.html Quoting further: Pointer guarding is a security mechanism whereby some pointers to code stored in writable program memory (return addresses saved by setjmp(3) or function pointers used by various glibc internals) are mangled semi-randomly to make it more difficult for an attacker to hijack the pointers for use in the event of a buffer overrun or stack-smashing attack. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||