T09 · Insecure Skill Coding Practices
Error
- Location
scripts/office/soffice.py:75- Finding
Predictable Temporary Shared Object Trusted for LD_PRELOAD Injection
- Content
View full analysis
bool: # AF_UNIX / LD_PRELOAD shim is Linux-only; skip on Windows and macOS if not hasattr(socket, "AF_UNIX"): return False try: s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) s.close() return False except OSError: return True def _ensure_shim() -> Path: if _SHIM_SO.exists(): return _SHIM_SO src = Path(tempfile.gettempdir()) / "lo_socket_shim.c" src.write_text(_SHIM_SOURCE) subprocess.run( ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], check=True, capture_output=True, ) src.unlink() return _SHIM_SO ``` The returned shared object is subsequently added to LibreOffice's environment: ```python def get_soffice_env() -> dict: env = os.environ.copy() if platform.system() == "Linux": env["SAL_USE_VCLPLUGIN"] = "svp" if _needs_shim(): shim = _ensure_shim() env["LD_PRELOAD"] = str(shim) return env ``` ### Technical Analysis The shared library is stored under the fixed path `/tmp/lo_socket_shim.so`. If that path already exists, `_ensure_shim()` returns it without checking: - Whether it is a regular file or a symbolic link - Its owner or permissions - Whether its contents match the expected shim - Whether it was created by the current process - Whether another process replaced it between validation and use When AF_UNIX socket creation fails, `get_soffice_env()` places the trusted path in `LD_PRELOAD`. The operating-system loader then loads and executes the library inside every LibreOffice process started with that environment. This creates a time-of-check/time-of-use and pre ...[truncated 1849 chars]- Remediation
View remediation