security implications of Java's System.load vs System.loadLibrary

Question

Jumping from https://stackoverflow.com/questions/7016391/difference-between-system-load-and-system-loadlibrary-in-java

What are the security implications of both approach ?

System.loadLibrary("_name_");
- Automatically searches for a library named "lib_name_.so" in $LD_LIBRARY_PATH
System.load("/PATH/TO/_name_.so");
- do load "/PATH/TO/_name_.so"

You've mentioned `loadLibrary` two times. Shouldn't the second one be `System.load`? — Rob W, May 10 '13 at 20:07

score 7 · Accepted Answer · answered May 10 '13 at 18:33

System.loadLibrary() refuses to load "libraries" with the path separator appearing in the name; see this excerpt from Java's source code (in java.lang.Runtime.java):

synchronized void loadLibrary0(Class fromClass, String libname) {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkLink(libname);
    }
    if (libname.indexOf((int)File.separatorChar) != -1) {
        throw new UnsatisfiedLinkError(
"Directory separator should not appear in library name: " + libname);
    }
    ClassLoader.loadLibrary(fromClass, libname, false);
}

As such, you could imagine allowing System.loadLibrary() but rejecting System.load(), giving access to only a specific set of loadable "safe" libraries... however, this seems indirect and fragile. The "normal" way of restricting native code loading is through SystemManager.checkLink(), which is called from both System.load() and System.loadLibrary(). In that case, there is no real difference in security between the two methods.

score 6 · Answer 2 · edited Oct 03 '21 at 09:35

6

Relying on the calling system to help locate things can certainly lead down odd paths. The biggest problem is that the system may provide a file that wasn't intended to be loaded by the application. If an attacker can place a file in a location that falls under the search, then the attacker can inject arbitrary code into the application and execute it. E.g. an arbitrary code execution vulnerability

(http://en.wikipedia.org/wiki/Arbitrary_code_execution). https://cwe.mitre.org/data/definitions/114.html

If you specify the exact path, you have the ability to protect the loaded file through things like file permissions, etc.

edited Oct 03 '21 at 09:35

Community

1

answered May 10 '13 at 18:26

Steve

15,155
3
37
66

extra question : what if the library path has to be passed by command line ? I have to replace a failing autodiscovery mecanism and, following the KISS principle, would tend to use `System.load(..)` with the full path provided by the command line at runtime – Cerber May 10 '13 at 18:33
Regarding "lead down odd paths", what if you'd already have `SystemManager.checkLink` properly implemented? – Pacerier Jun 18 '17 at 03:31

security implications of Java's System.load vs System.loadLibrary

2 Answers2