ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibcUpgrade glibc-develUpgrade nptl-develUpgrade glibc-utilsUpgrade nscdUpgrade glibc-commonUpgrade glibc-headersUpgrade glibc-profile | Dec 1, 2016 | Mar 30, 2011 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | Mar 30, 2011 |
| Oracle_linux | — | Upgrade glibc-headersUpgrade nscdUpgrade glibcUpgrade glibc-staticUpgrade glibc-develUpgrade glibc-utilsUpgrade glibc-common | Oct 16, 2024 | Mar 30, 2011 |
| Suse | — | Upgrade glibc-develUpgrade glibc-i18ndataUpgrade glibc-htmlUpgrade glibc-langUpgrade glibcUpgrade glibc-devel-32bitUpgrade glibc-locale-baseUpgrade glibc-devel-staticUpgrade glibc-utilsUpgrade glibc-gconv-modules-extraUpgrade glibc-locale-32bitUpgrade glibc-localeUpgrade glibc-32bitUpgrade glibc-profileUpgrade glibc-infoUpgrade nscdUpgrade glibc-extra | Aug 9, 2024 | Jul 9, 2013 |
| Vmsa 2012 0013 | — | Upgrade VMware ESX 4.1 to build number 800380 | Sep 17, 2012 | Mar 30, 2011 |
| Vmsa 2012 0018 | — | Upgrade VMware ESXi 5.0 to build number 912577Upgrade VMware ESXi 5.1 to build number 911593 | Jan 4, 2013 | Mar 30, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub