Search for vulnerabilities
Vulnerability details: VCID-ebra-cryr-aaap
Vulnerability ID VCID-ebra-cryr-aaap
Aliases CVE-2017-16997
Summary elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
Status Published
Exploitability 0.5
Weighted Severity 8.4
Risk 4.2
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-426 Untrusted Search Path
CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
System Score Found at
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16997.html
cvssv3.1 5.4 https://access.redhat.com/errata/RHBA-2019:0327
generic_textual MODERATE https://access.redhat.com/errata/RHBA-2019:0327
rhas Moderate https://access.redhat.com/errata/RHSA-2018:3092
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-16997.json
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00139 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00139 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00139 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00139 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00813 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00844 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00844 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.00844 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.01861 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.02192 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.02192 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.02192 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.02192 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.02192 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.02192 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.02192 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
epss 0.0689 https://api.first.org/data/v1/epss?cve=CVE-2017-16997
generic_textual Low https://bugs.debian.org/884615
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1526865
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16997
cvssv2 7.2 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 7.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 9.3 https://nvd.nist.gov/vuln/detail/CVE-2017-16997
cvssv3 7.8 https://nvd.nist.gov/vuln/detail/CVE-2017-16997
generic_textual Low https://sourceware.org/bugzilla/show_bug.cgi?id=22625
generic_textual Low https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html
generic_textual High https://ubuntu.com/security/notices/USN-3534-1
generic_textual High https://usn.ubuntu.com/usn/usn-3534-1
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-16997.html
https://access.redhat.com/errata/RHBA-2019:0327
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-16997.json
https://api.first.org/data/v1/epss?cve=CVE-2017-16997
https://bugs.debian.org/884615
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16997
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://sourceware.org/bugzilla/show_bug.cgi?id=22625
https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html
https://ubuntu.com/security/notices/USN-3534-1
https://usn.ubuntu.com/usn/usn-3534-1
http://www.securityfocus.com/bid/102228
1526865 https://bugzilla.redhat.com/show_bug.cgi?id=1526865
884615 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884615
cpe:2.3:a:gnu:glibc:2.19:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:2.19:*:*:*:*:*:*:*
cpe:2.3:a:gnu:glibc:2.20:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:2.20:*:*:*:*:*:*:*
cpe:2.3:a:gnu:glibc:2.21:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:2.21:*:*:*:*:*:*:*
cpe:2.3:a:gnu:glibc:2.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:2.22:*:*:*:*:*:*:*
cpe:2.3:a:gnu:glibc:2.23:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:2.23:*:*:*:*:*:*:*
cpe:2.3:a:gnu:glibc:2.25:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:2.25:*:*:*:*:*:*:*
cpe:2.3:a:gnu:glibc:2.26:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:glibc:2.26:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVE-2017-16997 https://nvd.nist.gov/vuln/detail/CVE-2017-16997
GLSA-201804-02 https://security.gentoo.org/glsa/201804-02
RHSA-2018:3092 https://access.redhat.com/errata/RHSA-2018:3092
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHBA-2019:0327
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-16997.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2017-16997
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-16997
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.36796
EPSS Score 0.00084
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.