Search for vulnerabilities
| Vulnerability ID | VCID-z9z9-2myw-aaaq |
| Aliases |
CVE-2010-3856
|
| Summary | ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 8.0 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| CWE-264 | Permissions, Privileges, and Access Controls |
| CWE-426 | Untrusted Search Path |
| Data source | Exploit-DB |
|---|---|
| Date added | Oct. 22, 2010 |
| Description | GNU C Library 2.x (libc6) - Dynamic Linker LD_AUDIT Arbitrary DSO Load Privilege Escalation |
| Ransomware campaign use | Known |
| Source publication date | Oct. 22, 2010 |
| Exploit type | local |
| Platform | linux |
| Source update date | Oct. 22, 2010 |
| Source URL | http://marc.info/?l=full-disclosure&m=128776663124692&w=2 |
| Data source | Metasploit |
|---|---|
| Description | This module attempts to gain root privileges on Linux systems by abusing a vulnerability in the GNU C Library (glibc) dynamic linker. glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not properly restrict use of the LD_AUDIT environment variable when loading setuid executables. This allows loading arbitrary shared objects from the trusted library search path with the privileges of the suid user. This module uses LD_AUDIT to load the libpcprofile.so shared object, distributed with some versions of glibc, and leverages arbitrary file creation functionality in the library constructor to write a root-owned world-writable file to a system trusted search path (usually /lib). The file is then overwritten with a shared object then loaded with LD_AUDIT resulting in arbitrary code execution. This module has been tested successfully on glibc version 2.11.1 on Ubuntu 10.04 x86_64 and version 2.7 on Debian 5.0.4 i386. RHEL 5 is reportedly affected, but untested. Some glibc distributions do not contain the libpcprofile.so library required for successful exploitation. |
| Note | Stability: - crash-safe Reliability: - repeatable-session SideEffects: - artifacts-on-disk |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 18, 2010 |
| Platform | Linux |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.00344 |
| EPSS Score | 0.00042 |
| Published At | Nov. 1, 2024, midnight |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| There are no relevant records. | ||||