Описание
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
It was found that the dynamic loader did not sanitize the LD_POINTER_GUARD environment variable. An attacker could use this flaw to bypass the pointer guarding protection on set-user-ID or set-group-ID programs to execute arbitrary code with the permissions of the user running the application.
Меры по смягчению последствий
The glibc pointer guard is a post-exploitation mitigation mechanism. As such, it is only relevant if there are exploitable security vulnerabilities in the system. Therefore, applying available security updates to the system is a possible mitigation for this issue. In typical deployments, environment variables can only be set by users with shell access. Restricting shell access to trusted users is another possible mitigation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | glibc | Will not fix | ||
| Red Hat Enterprise Linux 6 | glibc | Will not fix | ||
| Red Hat Enterprise Linux 7 | glibc | Fixed | RHSA-2017:1916 | 01.08.2017 |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
3.7 Low
CVSS2
Связанные уязвимости
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
The process_envvars function in elf/rtld.c in the GNU C Library (aka g ...
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
ELSA-2017-1916: glibc security, bug fix, and enhancement update (MODERATE)
EPSS
7 High
CVSS3
3.7 Low
CVSS2