keyctl commands throw 'undefined symbol: dlopen' errors

Question

I am running Centos 5.8 on a production server. I have an application that needs to use the keyctl command, but everytime the app calls (or I call) the command, I have some errors.

The first error was this:

root@server [~] keyctl show
segmentation fault

Then, I re-installed the keyutils binaries using yum. These are the keyutils packages I have on the server:

root@server [~]# rpm -qa | grep keyutils 
keyutils-libs-1.2-1.el5 
keyutils-libs-1.2-1.el5 
keyutils-1.2-1.el5 
keyutils-libs-devel-1.2-1.el5

And now, I have another different error:

root@server [~]# keyctl show
keyctl: symbol lookup error: /lib64/libkeyutils.so.1: undefined symbol: dlopen

I checked the libraries of keyctl, and libdl is not there.

root@server [~]# ldd /bin/keyctl  
linux-vdso.so.1 => (0x00007fffcc5fd000) 
libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00000033df000000) 
libc.so.6 => /lib64/libc.so.6 (0x0000003d7ae00000) 
/lib64/ld-linux-x86-64.so.2 (0x0000003d7aa00000)

All libraries that uses are fine.

root@server [~]# ls -al /lib64/libkeyutils* 
-rwxr-xr-x 1 root root 9472 Jan 6 2007 /lib64/libkeyutils-1.2.so* 
lrwxrwxrwx 1 root root 18 Nov 21 07:56 /lib64/libkeyutils.so.1 -> libkeyutils.so.1.9* 
-rwxr-xr-x 1 root root 34584 Jan 6 2007 /lib64/libkeyutils.so.1.9*

root@server [~]# ls -al /lib64/libdl* 
-rwxr-xr-x 1 root root 23360 Aug 27 08:59 /lib64/libdl-2.5.so* 
lrwxrwxrwx 1 root root 12 Nov 16 02:01 /lib64/libdl.so.2 -> libdl-2.5.so* 
root@server [~]#

Have you ever seen this problem before? I tried run the same version on others distros and it works.

I would like to re-install this server, but I can't because it is a production server.

Is there a way I can add or link a shared library to a binary already linked to others .so libraries?

Answer 1

LD_PRELOAD=/lib64/libdl-2.5.so keyctl show

Answer 2

Look at: http://blog.solidshellsecurity.com/2013/02/08/sshd-spam-rootkit-lib64libkeyutils-so-1-9/

It appears that there is no such legitimate file as libkeyutils.so.1.9 It is a rootkit, the latest legitimate version of this library is libkeyutils.so.1.3 on CentOS 6.3 (final).

rm -f /lib64/libkeyutils.so.1.9
ldconfig
/etc/init.d/sshd restart

There's also a suspected (as of now) unpatched user escalation priviledge flaw in all CentOS and RedHat kernels: https://access.redhat.com/security/cve/CVE-2013-0871 and http://blog.configserver.com/index.php?itemid=716

You may also need to reinstall SSH:

• https://serverfault.com/questions/476954/remove-shared-library-from-sshd
• https://forums.cpanel.net/f185/sshd-rootkit-323962.html