Executive brief
Relibc is a standard C library used by the Redox operating system to handle core system functions, including loading external software modules. A vulnerability exists where the library fails to properly handle malformed files when a program tries to load a shared library. An attacker could use a specially crafted file to cause the application to crash, resulting in a denial of service.
Technical details
A reachable unwrap panic exists in the DSO::mmap_and_copy function within src/ld_so/dso.rs of relibc (specifically commit 61f42d). The vulnerability is triggered when the dlopen() function is called on a malformed ELF shared library that does not contain a PT_LOAD segment. Because the code uses .unwrap() on a Result that returns an error in this scenario, the process terminates with a panic. This allows a local attacker to cause a denial of service (DoS) of any process that can be induced to load an arbitrary library file. A fix has been proposed in merge request 1046 to improve error handling.
Affected products
- Redox OS relibc commit 61f42d6b93adc552a9e8b6f207fca907e8ca8be2
Timeline
- 2026-02-27: patched: Merge request 1046 submitted to fix the issue
- 2026-06-26: disclosed: CVE published