CVE-2022-1117: Files or Directories Accessible to External Parties (CWE-552)
value: A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.
CWE description: The product makes files or directories accessible to unauthorized actors, even though they should not be.
CVSS v3 base score: 8.4
Published: 2022-08-29T15:15Z
Repository: https://github.com/linux-application-whitelisting/fapolicyd
Language: Other
Files changed: fapolicyd.spec, m4/dyn_linker.m4
Commit date: 2022-05-24 11:51:10 -0400
Commit message: Fix for CVE-2022-1117

The build script makes an assumption how glibc names it's runtime linker.
This worked fine until glibc-2.34. Starting with that, the naming
convention changed from /usr/lib64/ld-2.*.so to /lib64/ld-linux-x86-64.so.2
The upshot of this is the build script misdetects the run time linker
and this causes the ld_so pattern matcher to not work correctly.
Additionally, non-x86_64 platforms may not have followed the ld-2.*.so
pattern and were misdeteced prior to glibc-2.34.

Would like to thank NCCGroup for reporting this problem.

Diff: diff --git a/fapolicyd.spec b/fapolicyd.spec
index 08a5675..49ab3b7 100644
--- a/fapolicyd.spec
+++ b/fapolicyd.spec
@@ -28,11 +28,19 @@ makes use of the kernel's fanotify interface to determine file access rights.
 %setup -q
 
 # generate rules for python
 sed -i "s/%python2_path%/`readlink -f %{__python2} | sed 's/\//\\\\\//g'`/g" rules.d/*.rules
 sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" rules.d/*.rules
-sed -i "s/%ld_so_path%/`find /usr/lib64/ -type f -name 'ld-2\.*.so' | sed 's/\//\\\\\//g'`/g" rules.d/*.rules
+
+# Detect run time linker directly from bash
+interpret=`readelf -e /usr/bin/bash \
+		| grep Requesting \
+		| sed 's/.$//' \
+		| rev | cut -d" " -f1 \
+		| rev`
+
+sed -i "s|%ld_so_path%|`realpath $interpret`|g" rules.d/*.rules
 
 %build
 %configure \
     --with-audit \
     --disable-shared
diff --git a/m4/dyn_linker.m4 b/m4/dyn_linker.m4
index 8dac75b..0e269e9 100644
--- a/m4/dyn_linker.m4
+++ b/m4/dyn_linker.m4
@@ -1,6 +1,10 @@
 AC_DEFUN([LD_SO_PATH],
 [
-  xpath=`realpath /usr/lib64/ld-2.*.so`
+  xpath1=`readelf -e /usr/bin/bash | grep Requesting | sed 's/.$//' | rev | cut -d" " -f1 | rev`
+  xpath=`realpath $xpath1`
+  if test ! -f "$xpath" ; then
+    AC_MSG_ERROR([Cant find the dynamic linker])
+  fi
   echo "dynamic linker is.....$xpath"
   AC_DEFINE_UNQUOTED(SYSTEM_LD_SO, ["$xpath"], [dynamic linker])
 ])

Vulnerable code: sed -i "s/%ld_so_path%/`find /usr/lib64/ -type f -name 'ld-2\.*.so' | sed 's/\//\\\\\//g'`/g" rules.d/*.rules
  xpath=`realpath /usr/lib64/ld-2.*.so`
Fixed code: 
# Detect run time linker directly from bash
interpret=`readelf -e /usr/bin/bash \
		| grep Requesting \
		| sed 's/.$//' \
		| rev | cut -d" " -f1 \
		| rev`

sed -i "s|%ld_so_path%|`realpath $interpret`|g" rules.d/*.rules
  xpath1=`readelf -e /usr/bin/bash | grep Requesting | sed 's/.$//' | rev | cut -d" " -f1 | rev`
  xpath=`realpath $xpath1`
  if test ! -f "$xpath" ; then
    AC_MSG_ERROR([Cant find the dynamic linker])
  fi