T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/office/soffice.py:25- Finding
Predictable LD_PRELOAD Library Enables Local Tool Hijacking
- Content
View full analysis
dict: env = os.environ.copy() env["SAL_USE_VCLPLUGIN"] = "svp" if _needs_shim(): shim = _ensure_shim() env["LD_PRELOAD"] = str(shim) return env _SHIM_SO = Path(tempfile.gettempdir()) / "lo_socket_shim.so" def _ensure_shim() -> Path: if _SHIM_SO.exists(): return _SHIM_SO src = Path(tempfile.gettempdir()) / "lo_socket_shim.c" src.write_text(_SHIM_SOURCE) subprocess.run( ["gcc", "-shared", "-fPIC", "-o", str(_SHIM_SO), str(src), "-ldl"], check=True, capture_output=True, ) src.unlink() return _SHIM_SO ``` ### Technical Analysis The shared library and C source use fixed, predictable names in the system-wide temporary directory: - `/tmp/lo_socket_shim.so` - `/tmp/lo_socket_shim.c` When `_SHIM_SO` already exists, `_ensure_shim()` trusts it without verifying its owner, permissions, type, content, or cryptographic digest. If Unix-domain sockets are unavailable, the unverified library is assigned to `LD_PRELOAD` and inherited by LibreOffice. `LD_PRELOAD` causes the dynamic loader to execute initialization code from the specified shared library before the target program's normal execution. Consequently, accepting an attacker-created library at this path is equivalent to executing attacker-controlled native code. There is also a race between checking whether the library exists, creating source and output files, and subsequently using the compiled library. Predictable paths in a shared temporary directory make symlink and replacement attacks possible. ### Attack Path 1. An attacker with local write access to the shared temporary directory creates `/tmp/lo_socket_shim.so`. 2. The malicious library contains a constructor that p ...[truncated 1004 chars]- Remediation
View remediation