CVE-2020-1752
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.
Risk Assessment
The risk to the organization includes the possibility of arbitrary code execution by a local attacker, which could lead to privilege escalation and system integrity compromise.
Recommendation
It is recommended to update glibc to version 2.32 or later and restrict access to the glob function for unprivileged users.
Other vulnerabilities in glibc
See all- CVE-2023-6779High
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This issue occurs when the syslog and vsyslog functions are called with a message larger than INT_MAX bytes, leading to an incorrect buffer size calculation and application crash.
- CVE-2015-5180High
The res_query function in libresolv in glibc before version 2.25 has a vulnerability that allows remote attackers to cause a denial of service through a NULL pointer dereference, leading to process crashes.
- CVE-2017-1000366High
glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, potentially resulting in arbitrary code execution. This affects glibc 2.25 and earlier.
- CVE-2015-5229High
The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.
- CVE-2016-2856High
In glibc versions before 2.19-18+deb8u4 on Debian jessie and before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS, 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS, 2.21-0ubuntu4.2 on Ubuntu 15.10, and 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10, there is a lack of namespace check associated with file-descriptor passing. This allows local users to capture keystrokes and spoof data, potentially gaining privileges.
- CVE-2015-0235High
CVE-2015-0235 involves a heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc in versions 2.2 and other 2.x versions before 2.18. This allows attackers to execute arbitrary code via the gethostbyname or gethostbyname2 functions.
- CVE-2014-4043High
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, allowing context-dependent attackers to trigger use-after-free vulnerabilities.
- CVE-2024-33600Medium
In glibc 2.15, a bug was introduced in the nscd daemon that causes a null pointer dereference when a not-found netgroup response is not added to the cache. This leads to a crash of nscd.
- CVE-2023-4813Medium
A flaw in glibc may cause the gaih_inet function to use freed memory in uncommon situations, leading to an application crash. This issue is only exploitable when getaddrinfo is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=.
- CVE-2022-23219Critical
The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (glibc) through 2.34 copies its hostname argument on the stack without validating its length. This may result in a buffer overflow, potentially leading to a denial of service or, if an application is not built with a stack protector enabled, arbitrary code execution.
Original NVD description (English source)
A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS