On 2026-08-31 2:04 PM, Colin Walters wrote:
My instinct is that while it does seem good to say "we have a thing here" in response to the xz attack, in practice that particular vector is probably considered "burned" (i.e. unlikely to be reused in the same way) by the attackers.
I think it's important to not confuse the instance for the class. Function hijacking is a class of attacks. XZ-utils was an instance of function hijacking.
When an adversary actively uses an instance of an attack, they risk burning that instance. If the attack is detected, and if it is traced to an instance of a vulnerability, then that instance can be mitigated, and the attack can no longer be used against anyone who deploys the mitigation.
It's not enough that the vulnerability is revealed, deploying the mitigation is the action that burns the instance of the vulnerability. That is also true of attack classes. If no one deploys a mitigation against a class of attacks, then that class of attacks remains viable.
I can't actually think of an example of a class of attacks that has been burned. We know about SQL Injection, but we continue to see SQL Injection attacks. We know about about JS Prototype Poisoning, but we continue to see Prototype Poisoning attacks.
Function hijacking was a well known technique before 2024, and IFUNC was already considered risky. There are more people aware of that vector now, sure. But I don't think there's any reason to believe that it won't be used again unless it's something we actively look for. Especially so since I'm not aware of any changes in the linker that would prevent future recurrence.
The times this tool flags a problem will probably be 99% false positives (tool chain bugs, etc).
Yes, I'm sure that's true. In particular, I think the handling of symbols that appear in multiple libraries needs more thought.
There's quite a whole lot of possible attacks here of which mutating the GOT is just one. Also a core problem in the general case is it's running from the system it's trying to scan, which has all the same problems that antivirus systems have.
Antivirus systems are imperfect, and they wouldn't solve all possible problems even if they were. Yet anti-virus software is still widely used. An A-V system is not a guarantee against malware, but they do reduce the number of successful attacks on endpoints.
I don't think any security solution ever eliminates the need for other security tools, and I don't think it makes sense to run nothing while waiting for one comprehensive solution to all problems.
-- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
