For years, there’s been a known security vulnerability hiding in the GNU C Library (glibc). This library, which is critical for Linux and many other operating systems and programs, had a dynamic memory management security hole that could be used for denial of service (DoS) attacks. Now, the security company, Check Point, has issued an open-source patch, which will make it much more difficult to exploit this memory allocation (malloc) problem.
Check Point re-encountered this known problem when it discovered that so-called smart light bulbs could be used to hack into networks by exploiting unprotected single-linked-lists. The double-linked-list version of this problem had been fixed back in 2005 with Safe-Unlinking. But, the single-linked-list version, which is present in the memory primitive functions Fast-Bins and Thread Cache (TCache), remained vulnerable.
Now, the fix is in for this problem. This new built-in security mechanism is called Safe-Linking. It protects malloc by signing its single-linked-list pointers with random numbers derived from Linux’s Address Space Layout Randomization (ASLR) functionality. Combined with memory chunk alignment integrity checks, it protects the memory pointers from hijacking attempts and thus the system itself.
The patch is now being integrated with the most common standard C library implementation, glibc. Safe-Linking will be released in glibc 2.32 in August 2020. It’s already up and running in glibc’s popular embedded counterpart: uClibc-NG.
You may wonder why it took so long for this to be fixed since it was a known problem. Check Point’s technology lead, Eyal Itkin explained:
“While exploit developers have been aware of this problem for many years now, the developers of the libraries weren’t aware of a problem — so nothing got fixed. By giving developers the feedback, along with an idea for a fix, we managed to close this issue once and for all. Linux users should be aware of this update and make sure they switch to using the most updated version of their standard library, once it gets released.”
Still, even once you have the fix, Itkin continued:
“It is important to note that Safe-Linking is not a magic bullet that will stop all exploit attempts against modern-day heap implementations. However, this is another step in the right direction. From our past experience, this specific mitigation would have blocked several major exploits that we demonstrated throughout the years, thus turning ‘broken’ software products to ones that are ‘unexploitable.'”
