Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libversion: Fix unsafe concatenation of $LD_LIBRARY_PATH #89243

Merged
merged 1 commit into from May 31, 2020
Merged

libversion: Fix unsafe concatenation of $LD_LIBRARY_PATH #89243

merged 1 commit into from May 31, 2020

Conversation

andersk
Copy link
Contributor

@andersk andersk commented May 31, 2020

Motivation for this change

Naive concatenation of $LD_LIBRARY_PATH can result in an empty colon-delimited segment; this tells glibc to load libraries from the current directory, which is definitely wrong, and may be a security vulnerability if the current directory is untrusted. This particular case probably has no security relevance, but we should avoid this unsafe pattern anyway in case it gets copied. See #76804.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

@andersk
libversion: Fix unsafe concatenation of $LD_LIBRARY_PATH
665dfc2 
Naive concatenation of $LD_LIBRARY_PATH can result in an empty
colon-delimited segment; this tells glibc to load libraries from the
current directory, which is definitely wrong, and may be a security
vulnerability if the current directory is untrusted.  This particular
case probably has no security relevance, but we should avoid this
unsafe pattern anyway in case it gets copied.  See NixOS#76804.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
@ofborg ofborg bot requested a review from ryantm May 31, 2020 08:54
@ryantm ryantm merged commit 03147cf into NixOS:master May 31, 2020
@andersk andersk mentioned this pull request Nov 4, 2021
Closed
@andersk andersk deleted the libversion-LD_LIBRARY_PATH branch December 26, 2022 21:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ryantm ryantm ryantm approved these changes

Assignees
No one assigned
Labels
10.rebuild-darwin: 1-10 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@andersk @ryantm