⬇ Download holy card: ·
Saint Looney Tunables, Who Tunes Environment Variables
Patron of dynamic loaders, overly long environment variables, and cartoons that end with "That's all folks".
Life
On 3 October 2023 Qualys revealed a buffer overflow in ld.so, the glibc dynamic loader, in the way it parsed the GLIBC_TUNABLES variable. Handing a malformed variable to a setuid program was enough to become root on default installs of Fedora, Ubuntu and Debian. The flaw had arrived with glibc 2.34 in April 2021, and within weeks it joined CISA's catalogue of exploits seen in the wild.
Prayer
O Saint Looney Tunables, who makes the loader dance with a single variable, let our setuid programs not listen to every environment. Amen.
How to celebrate
Celebrated by updating glibc and watching an old cartoon, until somebody becomes root.
Tune it too tight and the string will snap.