It was discovered that the ld.so.cache in images generated by apko had file system permissions mode 0666:
bash-5.3# find / -type f -perm -o+w
/etc/ld.so.cache
This potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.
vishal-chdhry Remediation developer
codyharris-h2o-ai Reporter
eslerm Coordinator
It was discovered that the ld.so.cache in images generated by apko had file system permissions mode
0666:This issue was introduced in commit 04f37e2 ("generate /etc/ld.so.cache (#1629)")(v0.27.0).
Impact
This potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control.
Patches
This issue was addressed in apko in aedb077 ("fix: /etc/ld.so.cache file permissions (#1758)") (v0.29.5).
Acknowledgements
Many thanks to Cody Harris from H2O.ai for reporting this issue.