⬇ Download holy card: ·
⚔ Commemorated today: The Scourge of the Guardians of Peace (2014)☀ Commemorated today: The Miracle of the Log4Shell Report (2021)Saint badmalloc, Who Logged Allocations as Root
Patron of memory-allocation logs, suid binaries, and symbolic links planted at just the right moment.
Life
Gergely Kalman described badmalloc, a macOS privilege escalation: by setting certain environment variables, the MallocStackLogging framework was loaded even into suid-root binaries and wrote its logs to a folder of choice. By winning a race with a symbolic link and abusing a file descriptor inherited by child processes, one got a line written into /etc/sudoers.d granting root. Apple fixed it by hardening how the files are opened (CVE-2023-32428).
Prayer
O Saint badmalloc, who logs every allocation wherever you like, let our root binaries not follow the links they find. Amen.
How to celebrate
Celebrated by updating macOS and distrusting debug variables that survive into privileged binaries.
Write the logs as root and write only where you must.