Immediate fallout A vulnerability flagged as CVE-2024-3094 traces back to GNU's IFUNC (indirect function) mechanism, not the surrounding code as many initial analyses suggested. The Hacker News thread that surfaced th…

The discussion cites the public GitHub repository https://github.com/robertdfrench/ifuncd-up, where a proof‑of‑concept exploit demonstrates arbitrary code execution when a crafted binary invokes an IFUNC‑enabled funct…

How IFUNC works IFUNC is a GNU extension that allows a program to select an implementation of a function at load time based on runtime characteristics such as CPU features. The compiler emits a resolver function that …

Because the resolver runs before the program's main, it operates with the same privileges as the process and can execute arbitrary instructions. The resolver is typically small and trusted, but the Hacker News post hi…