ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glibc-utilsUpgrade glibc-headersUpgrade glibc-profileUpgrade nscdUpgrade glibc-commonUpgrade glibcUpgrade glibc-develUpgrade nptl-devel | Dec 1, 2016 | Mar 30, 2011 |
| Debian | — | Upgrade glibc | Jul 30, 2024 | Mar 30, 2011 |
| Oracle_linux | — | Upgrade nscdUpgrade glibc-headersUpgrade glibcUpgrade glibc-develUpgrade glibc-staticUpgrade glibc-utilsUpgrade glibc-common | Oct 16, 2024 | Mar 30, 2011 |
| Suse | — | Upgrade glibc-32bitUpgrade nscdUpgrade glibc-profileUpgrade glibc-infoUpgrade glibc-extraUpgrade glibc-devel-staticUpgrade glibc-localeUpgrade glibc-gconv-modules-extraUpgrade glibc-i18ndataUpgrade glibcUpgrade glibc-locale-baseUpgrade glibc-langUpgrade glibc-htmlUpgrade glibc-devel-32bitUpgrade glibc-develUpgrade glibc-utilsUpgrade glibc-locale-32bit | Aug 9, 2024 | Jul 9, 2013 |
| Vmsa 2012 0013 | — | Upgrade VMware ESX 4.1 to build number 800380 | Sep 17, 2012 | Mar 30, 2011 |
| Vmsa 2012 0018 | — | Upgrade VMware ESXi 5.0 to build number 912577Upgrade VMware ESXi 5.1 to build number 911593 | Jan 4, 2013 | Mar 30, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub