A local root vulnerability in glibc [LWN.net]

A local root vulnerability in glibc

Posted Oct 4, 2023 12:49 UTC (Wed) by smoogen (subscriber, #97)
In reply to: A local root vulnerability in glibc by iustin
Parent article: A local root vulnerability in glibc

As long as the setuid program dynamically links to libc. If it is statically built which some setuid are done then the setuid program will need to be recompiled.

to post comments

A local root vulnerability in glibc

Posted Oct 4, 2023 19:47 UTC (Wed) by iustin (subscriber, #102433) [Link] (4 responses)

Oh, I now realise my question was misunderstood.

I meant, it is enough to update libc6 without rebooting/restarting daemons, or do you need a full reboot? Since the vulnerability appears at ld.so/dynamic loading time, it appears that simply updating libc6 is enough.

It is of course obvious that statically linked binaries are never fixed by updating a shared library.

Running programs are not affected by updating their files

Posted Oct 5, 2023 8:34 UTC (Thu) by sdalley (subscriber, #18550) [Link] (3 responses)

It's not enough. A running program exists in memory or swap, and does not magically change just because its executable files or libraries have updated on disk. Any program which links to a library that was vulnerable will need to be terminated and restarted.

Running programs are not affected by updating their files

Posted Oct 5, 2023 8:38 UTC (Thu) by geert (subscriber, #98403) [Link] (2 responses)

In general, that is indeed true.
For this particular case, where the vulnerability is in the loader evaluating the GLIBC_TUNABLES environment variable, I guess the program is no longer vulnerable after it has been started.

Running programs are not affected by updating their files

Posted Oct 5, 2023 11:51 UTC (Thu) by hmh (subscriber, #3838) [Link] (1 responses)

It all depends on what gets used for the dynamic loader on a running process. execve() should be fine, the kernel would load the newer, fixed dynamic linker anyway.

And if your environment is currently safe, only applications that allow changing it and which do something weird in userspace with a cached copy of ld.so might need a restart. Maybe dlopen()?

Running programs are not affected by updating their files

Posted Oct 5, 2023 12:45 UTC (Thu) by iustin (subscriber, #102433) [Link]

Exactly, I was referring to this specific issue, not in general.