From owner-freebsd-bugs@FreeBSD.ORG Wed Jul 3 00:40:02 2013 Return-Path: Delivered-To: freebsd-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 38E1AEC6 for ; Wed, 3 Jul 2013 00:40:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id 2C3C01E12 for ; Wed, 3 Jul 2013 00:40:02 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.7/8.14.7) with ESMTP id r630e15q062314 for ; Wed, 3 Jul 2013 00:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.7/8.14.7/Submit) id r630e1Nw062313; Wed, 3 Jul 2013 00:40:01 GMT (envelope-from gnats) Date: Wed, 3 Jul 2013 00:40:01 GMT Message-Id: <201307030040.r630e1Nw062313@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: Shawn Webb Subject: Re: kern/180077: [rtld] [security] Potential DoS in RTLD X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: Shawn Webb List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2013 00:40:02 -0000 The following reply was made to PR kern/180077; it has been noted by GNATS. From: Shawn Webb To: bug-followup@FreeBSD.org, lattera@gmail.com Cc: Subject: Re: kern/180077: [rtld] [security] Potential DoS in RTLD Date: Tue, 2 Jul 2013 20:31:21 -0400 I understand that. I also understand that we're loading shared objects that can do what they want, since the purpose of a shared object is to execute code. If the author of a shared object wanted to DoS the service/system or execute arbitrary code, he could simply add code to do so. I just stumbled across this the other day and thought that it technically is a bug. A one-word fix would be easy to implement and could prevent weird headaches. I wouldn't regard the bug as important at all, given what I just previously said. The point is that it's still technically a bug.