Red Hat Bugzilla – Bug 1200138
binutils: ld sporadically generates binaries without relro protection even when told so
Last modified: 2015-11-18 22:41:02 EST
Created attachment 999663 [details] reproducer.tar.gz Description of problem: Binaries generated by ld sometimes lack relro protection, although it has explicitly been requested on the command line. This has potential security implications, please treat this as embargoed for now. We will decide how to disclose this once we better understand this issue. Version-Release number of selected component (if applicable): binutils-2.23.52.0.1-16.el7.x86_64 How reproducible: Always (with the reproducer). Steps to Reproduce: tar xf reproducer.tar.gz cd reproducer cmd="/usr/bin/ld --eh-frame-hdr --build-id -m elf_x86_64 -shared -o output.so -L. crti.o crtbeginS.o winbind_krb5_locator_17.o -z relro -z now -no-undefined --export-dynamic -lpthread --as-needed -rpath XXX -Bdynamic -lwbclient -lc crtendS.o crtn.o" $(echo "$cmd" | sed s/-rpath.XXX//); eu-readelf -a output.so | grep RELRO $cmd; eu-readelf -a output.so | grep RELRO Actual results: [fweimer@oldenburg reproducer]$ $(echo "$cmd" | sed s/-rpath.XXX//); eu-readelf -a output.so | grep RELRO GNU_RELRO 0x001d68 0x0000000000201d68 0x0000000000201d68 0x000298 0x000298 R 0x1 01 [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] .bss 02 [RELRO: .dynamic] 06 [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] [fweimer@oldenburg reproducer]$ $cmd; eu-readelf -a output.so | grep RELRO [fweimer@oldenburg reproducer]$ (relro only in the first case.) Expected results: [fweimer@oldenburg reproducer]$ $(echo "$cmd" | sed s/-rpath.XXX//); eu-readelf -a output.so | grep RELRO GNU_RELRO 0x001d68 0x0000000000201d68 0x0000000000201d68 0x000298 0x000298 R 0x1 01 [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] .bss 02 [RELRO: .dynamic] 06 [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] [fweimer@oldenburg reproducer]$ $cmd; eu-readelf -a output.so | grep RELRO GNU_RELRO 0x001d68 0x0000000000201d68 0x0000000000201d68 0x000298 0x000298 R 0x1 01 [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] .bss 02 [RELRO: .dynamic] 06 [RELRO: .ctors .dtors .jcr .data.rel.ro .dynamic .got] [fweimer@oldenburg reproducer]$ (relro in both cases.) Additional info: The reproducer is constructed in such a way that it should not depend on installed system libraries; in this case, they come from RHEL 6.6. With different libc versions, this reproducer does not show the bug, although we have seen similar issues with the RHEL 7 libc.
Also reproducible with binutils-2.24-30.fc21.x86_64.
Please see https://sourceware.org/bugzilla/show_bug.cgi?id=14207 https://sourceware.org/bugzilla/show_bug.cgi?id=16322 https://sourceware.org/bugzilla/show_bug.cgi?id=16323 The issue was fixed by the https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commit;h=43a8475ca01b676fb764aaed0c4ed1cc16fc3c87 commit, but there has been a follow-up to that: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=eec2f3ed9f053653ed5d629eb50e08e3ee61e9bd
The reproducer does not work with binutils-2.25-5.fc22.x86_64 from Fedora 22 and binutils-2.25-6.fc23.x86_64 from current Fedora rawhide. No need to embargo this because it is public information, based on the upstream discussion/commits Jakub provided.
Verified for build binutils-2.23.52.0.1-54.el7.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-2079.html