Running programs are not affected by updating their files [LWN.net]

Running programs are not affected by updating their files

Posted Oct 5, 2023 8:34 UTC (Thu) by sdalley (subscriber, #18550)
In reply to: A local root vulnerability in glibc by iustin
Parent article: A local root vulnerability in glibc

It's not enough. A running program exists in memory or swap, and does not magically change just because its executable files or libraries have updated on disk. Any program which links to a library that was vulnerable will need to be terminated and restarted.

to post comments

Running programs are not affected by updating their files

Posted Oct 5, 2023 8:38 UTC (Thu) by geert (subscriber, #98403) [Link] (2 responses)

In general, that is indeed true.
For this particular case, where the vulnerability is in the loader evaluating the GLIBC_TUNABLES environment variable, I guess the program is no longer vulnerable after it has been started.

Running programs are not affected by updating their files

Posted Oct 5, 2023 11:51 UTC (Thu) by hmh (subscriber, #3838) [Link] (1 responses)

It all depends on what gets used for the dynamic loader on a running process. execve() should be fine, the kernel would load the newer, fixed dynamic linker anyway.

And if your environment is currently safe, only applications that allow changing it and which do something weird in userspace with a cached copy of ld.so might need a restart. Maybe dlopen()?

Running programs are not affected by updating their files

Posted Oct 5, 2023 12:45 UTC (Thu) by iustin (subscriber, #102433) [Link]

Exactly, I was referring to this specific issue, not in general.