CVE-2010-3856
ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.2%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 11.16% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- gnu/glibc
- Source
- secalert@redhat.com
References
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
- http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2010/Oct/344
- http://seclists.org/fulldisclosure/2019/Jun/18
- http://seclists.org/fulldisclosure/2023/Jul/31
- http://secunia.com/advisories/42787Vendor Advisory
- http://security.gentoo.org/glsa/glsa-201011-01.xml
- http://sourceware.org/ml/libc-hacker/2010-10/msg00010.htmlPatch
- http://support.avaya.com/css/P8/documents/100121017
- http://www.debian.org/security/2010/dsa-2122
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:212
- http://www.openwall.com/lists/oss-security/2023/07/19/9
- http://www.openwall.com/lists/oss-security/2023/07/20/1
- http://www.redhat.com/support/errata/RHSA-2010-0872.html
- http://www.securityfocus.com/archive/1/515545/100/0/threaded
- http://www.securityfocus.com/bid/44347
- http://www.ubuntu.com/usn/USN-1009-1
- http://www.vmware.com/security/advisories/VMSA-2011-0001.html
- http://www.vupen.com/english/advisories/2011/0025Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=645672Patch
- https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html
- https://rhn.redhat.com/errata/RHSA-2010-0793.html
- https://seclists.org/bugtraq/2019/Jun/14
- https://www.exploit-db.com/exploits/44025/
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
- http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2010/Oct/344
- http://seclists.org/fulldisclosure/2019/Jun/18
- http://seclists.org/fulldisclosure/2023/Jul/31
- http://secunia.com/advisories/42787Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.