[ltt-dev] [PATCH UST] Fix insecure library loading (Debian Bug #598309, CVE-2010-3386)

[David Goulet]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hey Nils,

Good thing for the release. Important side note. We *must* detail very carefully
in the changelog the change of the API for tracepoints that needs a data
pointer. The old tracepoints, on next release, will only dump warnings at
compile time and the tracepoints will *not* works. (There is an error at compile
if the register_trace_* is used at init() though).

Just a reminder
Thanks!

David

On 10-09-29 02:57 PM, Nils Carlson wrote:
> Looks good,
> 
> I will test it and integrate it tomorrow. Hopefully I can make a new
> release by the end of the week.
> 
> /Nils
> On Sep 29, 2010, at 5:06 PM, Mathieu Desnoyers wrote:
> 
>> Thanks to Raphael Geissert for spotting this, and to Jon Bernard for
>> forwarding
>> the information to us.
>>
>> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers at efficios.com>
>> CC: Raphael Geissert <geissert at debian.org>
>> CC: Jon Bernard <jbernard at debian.org>
>> ---
>> usttrace |   47 +++++++++++++++++++++++++++++++++++++----------
>> 1 file changed, 37 insertions(+), 10 deletions(-)
>>
>> Index: ust/usttrace
>> ===================================================================
>> --- ust.orig/usttrace
>> +++ ust/usttrace
>> @@ -132,27 +132,54 @@ fi
>>
>>     if [ "$arg_preload_libust" = "1" ];
>>     then
>> -    if [ -n "${LIBUST_PATH%libust.so}" ] ; then
>> -        export
>> LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${LIBUST_PATH%libust.so}"
>> +    if [ -n "${LIBUST_PATH%libust.so}" ];
>> +    then
>> +        if [ -n "$LD_LIBRARY_PATH" ];
>> +        then
>> +            export
>> LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${LIBUST_PATH%libust.so}"
>> +        else
>> +            export LD_LIBRARY_PATH="${LIBUST_PATH%libust.so}"
>> +        fi
>> +    fi
>> +    if [ -n "$LIBUST_PATH" ];
>> +    then
>> +        if [ -n "$LD_PRELOAD" ];
>> +        then
>> +            export LD_PRELOAD="$LD_PRELOAD:$LIBUST_PATH"
>> +        else
>> +            export LD_PRELOAD="$LIBUST_PATH"
>> +        fi
>>     fi
>> -    export LD_PRELOAD="$LD_PRELOAD:$LIBUST_PATH"
>>     fi
>>
>> -    if [ "$arg_ld_std_ust" = "1" ];
>> +    if [ "$arg_ld_std_ust" = "1" ] && [ -n "${LIBUST_PATH%libust.so}" ];
>>     then
>> -    if [ -n "$${LIBUST_PATH%libust.so}" ] ; then
>> -        export
>> LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${LIBUST_PATH%libust.so}"
>> +    if [ -n "$LD_LIBRARY_PATH" ];
>> +    then
>> +        export
>> LD_LIBRARY_PATH="$LD_LIBRARY_PATH:${LIBUST_PATH%libust.so}"
>> +    else
>> +        export LD_LIBRARY_PATH="${LIBUST_PATH%libust.so}"
>>     fi
>>     fi
>>
>> -    if [ "$arg_preload_malloc" = "1" ];
>> +    if [ "$arg_preload_malloc" = "1" ] && [ -n $LIBMALLOCWRAP_PATH ];
>>     then
>> -    export LD_PRELOAD="$LD_PRELOAD:$LIBMALLOCWRAP_PATH"
>> +    if [ -n "$LD_PRELOAD" ];
>> +    then
>> +        export LD_PRELOAD="$LD_PRELOAD:$LIBMALLOCWRAP_PATH"
>> +    else
>> +        export LD_PRELOAD="$LIBMALLOCWRAP_PATH"
>> +    fi
>>     fi
>>
>> -    if [ "$arg_preload_fork" = "1" ];
>> +    if [ "$arg_preload_fork" = "1" ] && [ -n $LIBINTERFORK_PATH ];
>>     then
>> -    export LD_PRELOAD="$LD_PRELOAD:$LIBINTERFORK_PATH"
>> +    if [ -n "$LD_PRELOAD" ];
>> +    then
>> +        export LD_PRELOAD="$LD_PRELOAD:$LIBINTERFORK_PATH"
>> +    else
>> +        export LD_PRELOAD="$LIBINTERFORK_PATH"
>> +    fi
>>     fi
>>
>> # Execute the command
>>
>> -- 
>> Mathieu Desnoyers
>> Operating System Efficiency R&D Consultant
>> EfficiOS Inc.
>> http://www.efficios.com
>>
>> _______________________________________________
>> ltt-dev mailing list
>> ltt-dev at lists.casi.polymtl.ca
>> http://lists.casi.polymtl.ca/cgi-bin/mailman/listinfo/ltt-dev
> 
> 
> _______________________________________________
> ltt-dev mailing list
> ltt-dev at lists.casi.polymtl.ca
> http://lists.casi.polymtl.ca/cgi-bin/mailman/listinfo/ltt-dev

- -- 
David Goulet
LTTng project, DORSAL Lab.

1024D/16BD8563
BE3C 672B 9331 9796 291A  14C6 4AF7 C14B 16BD 8563
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkyjx5UACgkQSvfBSxa9hWOgPwCfVnk6+akGcVZk9KTYe8Gr9evo
lbIAoKzRP2TIpgR6wEkEYXQjHU7tbIcA
=Mv+g
-----END PGP SIGNATURE-----