T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/office/soffice.py:27- Finding
Predictable Temporary Shared Library Enables LD_PRELOAD Hijacking
- Content
View full analysis
dict: env = os.environ.copy() env["SAL_USE_VCLPLUGIN"] = "svp" if _needs_shim(): shim = _ensure_shim() env["LD_PRELOAD"] = str(shim) return env _SHIM_SO = Path(tempfile.gettempdir()) / "lo_socket_shim.so" def _ensure_shim() -> Path: if _SHIM_SO.exists(): return _SHIM_SO src = Path(tempfile.gettempdir()) / "lo_socket_shim.c" src.write_text(_SHIM_SOURCE) subprocess.run( ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], check=True, capture_output=True, ) src.unlink() return _SHIM_SO ``` ### Technical Analysis The shared-library path is a fixed, predictable filename in the system-wide temporary directory. If `/tmp/lo_socket_shim.so` already exists, the code accepts it without verifying its ownership, file type, permissions, integrity, or expected contents. When Unix-domain sockets are unavailable, `get_soffice_env()` places this file in `LD_PRELOAD`. The operating system's dynamic loader will then load the library into the LibreOffice process before normal dependencies. Consequently, an attacker who can create the filename before the legitimate process can substitute an arbitrary shared library. The source file `/tmp/lo_socket_shim.c` is also created through a predictable path without exclusive creation or symlink checks, creating an additional race condition during compilation. ### Attack Path 1. A local attacker monitors or predicts use of the document conversion functionality. 2. Before the first legitimate invocation, the attacker creates `/tmp/lo_socket_shim.so` containing malicious constructor code. 3. The Skill runs in an environment where `_needs_shim()` returns `True`. 4. `_ensure_shim()` o ...[truncated 808 chars]- Remediation
View remediation