ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nptl-develUpgrade glibcUpgrade glibc-develUpgrade glibc-commonUpgrade nscdUpgrade glibc-profileUpgrade glibc-utilsUpgrade glibc-headers | Dec 1, 2016 | Mar 30, 2011 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | Mar 30, 2011 |
| Oracle_linux | — | Upgrade glibc-commonUpgrade glibc-staticUpgrade glibc-utilsUpgrade glibc-develUpgrade glibcUpgrade nscdUpgrade glibc-headers | Oct 16, 2024 | Mar 30, 2011 |
| Suse | — | Upgrade glibc-develUpgrade glibc-devel-staticUpgrade glibc-locale-baseUpgrade glibc-i18ndataUpgrade glibc-gconv-modules-extraUpgrade glibc-devel-32bitUpgrade glibcUpgrade glibc-localeUpgrade glibc-locale-32bitUpgrade glibc-htmlUpgrade glibc-langUpgrade glibc-utilsUpgrade glibc-infoUpgrade glibc-extraUpgrade glibc-32bitUpgrade nscdUpgrade glibc-profile | Aug 9, 2024 | Jul 9, 2013 |
| Vmsa 2012 0013 | — | Upgrade VMware ESX 4.1 to build number 800380 | Sep 17, 2012 | Mar 30, 2011 |
| Vmsa 2012 0018 | — | Upgrade VMware ESXi 5.1 to build number 911593Upgrade VMware ESXi 5.0 to build number 912577 | Jan 4, 2013 | Mar 30, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub