While looking into some format string issue, i found that the warn() function does not seem to be protected by the glibc FORTIFY_SOURCE Format string protection mechanism. Here is a simple example to prove my point: [huzaifas@babylon ~]$ cat warn1.c #include <stdio.h> #include <err.h> void main(int argc, char *argv[]) { warn(argv[1]); //printf(argv[1]); } [huzaifas@babylon ~]$ gcc -O -g -D_FORTIFY_SOURCE=2 -o warn warn1.c [huzaifas@babylon ~]$ cat print.c #include <stdio.h> #include <err.h> void main(int argc, char *argv[]) { //warn(argv[1]); printf(argv[1]); } [huzaifas@babylon ~]$ gcc -O -g -D_FORTIFY_SOURCE=2 -o print print.c [huzaifas@babylon ~]$ ./warn "%100s%n" warn: ?▮�: Segmentation fault [huzaifas@babylon ~]$ ./print "%100s%n" *** %n in writable segment detected *** L�|�Aborted [huzaifas@babylon ~]$
The relevant functions were never meant to be protected by fortify source, so from a security point of view, this is an enhancement only. Since fixing this would break the ABI, we need to work with upstream to see if a protection for these functions can be included in future versions. In order to track this issue, I've filed a new, non-security bug for glibc in #838050.
*** This bug has been marked as a duplicate of bug 838050 ***
This is being tracked upstream here: https://sourceware.org/bugzilla/show_bug.cgi?id=24987