Linux found preloaded shared library: potential threat to security?

Question

On a Linux Raspbian system, I have performed variuos security checks and among those I have performed a rkhunter scan to seek for rootkits, backdoors, and other malicious software with the following warning:

Warning: Found preloaded shared library: /usr/lib/arm-linux-gnueabihf/libarmmem-${PLATFORM}.so

Potentially this is a shared library providing a way to access and manage memory on the ARM platform, such as system-level memory management and may get access to critical system resources.

As far I can understand preloaded shared library pose a security risk, meaning that it has the full access to user data, system resources, and user privileges and could be potentially manipulated to gain access to secure information or resources.

I have searched for a specific documentation on such preloaded shared library, but I am not able to find any documentation about it.

I am seeking the documentation of such preloaded shared library to better understand if it poses a security issue.

I have reviewed the available posts and none answer my question.

Any support is much appreciated.

Answer 1

That is just a bunch of optional optimized overrides for a few common string primitives functions, notably memcmp. The ${PLATFORM} placeholder selects what is deemed best for your CPU.

It is not configured with ill intent, though it will introduce conflicts with some software breaking because of how it is configured.

If you cared enough to worry about how it may introduce security problems due to receiving limited security review and being primarily aimed at making a slow development platform go slightly less slow, you would not use that platform in the first place. Probably best to leave it in place.

If you ever wonder what package a dpkg-installed regular file belongs to, ask dpkg -S:

-S, --search filename-search-pattern...

Search for packages that own files corresponding to the given pattern. Standard shell wildcard characters can be used in the pattern, where asterisk (*) and question mark (?) will match a slash, and backslash (\) will be used as an escape character.