CVE-2017-16997
HighSummary
In the GNU C Library (glibc) versions 2.19 through 2.26, there is a flaw in handling RPATH and RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE) programs. This allows local users to gain privileges via a Trojan horse library in the current working directory.
Risk Assessment
This vulnerability may lead to privilege escalation by local users, posing a serious security threat to the system. Although this configuration is uncommon, its presence can lead to unauthorized access.
Recommendation
It is recommended to update the glibc library to the latest version and to review and restrict the use of RPATH and RUNPATH in privileged programs. Additionally, monitoring application working directories for malicious libraries is advised.
Other vulnerabilities in GNU C Library (glibc)
See all- CVE-2017-8804High
The xdr_bytes and xdr_string functions in the GNU C Library (glibc) version 2.25 mishandle buffer deserialization failures, allowing remote attackers to cause a denial of service via a crafted UDP packet to port 111.
- CVE-2015-8983High
Integer overflow in the _IO_wstr_overflow function in the GNU C Library (glibc) before version 2.22 can lead to application crashes or potentially allow arbitrary code execution. Attackers can exploit this vulnerability by manipulating size calculations in bytes, triggering a heap-based buffer overflow.
- CVE-2016-5417High
A memory leak in the __res_vinit function in the IPv6 name server management code in GNU C Library (glibc) before version 2.24 allows remote attackers to cause a denial of service by leveraging partial initialization of internal resolver data structures.
- CVE-2016-6323High
The makecontext function in the GNU C Library (glibc) before version 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms. This may allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.
- CVE-2016-3706High
A stack-based buffer overflow in the getaddrinfo function in the GNU C Library (glibc) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion.
- CVE-2016-3075High
A stack-based buffer overflow exists in the nss_dns implementation of the getnetbyname function in GNU C Library (glibc) before version 2.24. Attackers can exploit this vulnerability by providing a long name, leading to application crashes.
- CVE-2016-1234High
A stack-based buffer overflow in the glob implementation in GNU C Library (glibc) before version 2.24 can be exploited by context-dependent attackers. This allows them to cause a denial of service (crash) by providing a long name.
- CVE-2015-7547High
Multiple stack-based buffer overflows in the libresolv library in GNU C Library (glibc) before version 2.23 exist in the send_dg and send_vc functions. Remote attackers can cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response.
- CVE-2015-5277High
The get_contents function in the GNU C Library (glibc) before version 2.20 may allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.
- CVE-2014-9402High
The nss_dns implementation of getnetbyname in GNU C Library (glibc) before version 2.21 allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being processed.
Original NVD description (English source)
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.