CVE-2010-3847: Medium severity gnu c library vulnerability
elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LDAUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory.
Other sources
Tavis Ormandy pointed out that glibc does not follow ELF specification recommendation that $ORIGIN expansion should not be performed for setuid/setgid programs. Tavis quoted:
http://web.archive.org/web/20041026003725/http://www.caldera.com/developers/gabi/2003-12-17/ch5.dynamic.html
For security, the dynamic linker does not allow use of $ORIGIN substitution sequences for set-user and set-group ID programs. For such sequences that appear within strings specified by DTRUNPATH dynamic array entries, the specific search path containing the $ORIGIN sequence is ignored (though other search paths in the same string are processed). $ORIGIN sequences within a DTNEEDED entry or path passed as a parameter to dlopen() are treated as errors. The same restrictions may be applied to processes that have more than minimal privileges on systems with installed extended security mechanisms.
Tavis showed that it's possible to escalate privileges by forcing $ORIGIN expansion from LDAUDIT (which is supposed to be ignored for setuid/setgid binaries, it's listed in UNSECUREENVVARS).
Acknowledgements:
Red Hat would like to thank Tavis Ormandy for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-3847?
CVE-2010-3847 is classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2010-3847?
To fix CVE-2010-3847, update the GNU C Library (glibc) to versions 2.11.3 or later, or apply the appropriate patches.
What types of systems are affected by CVE-2010-3847?
CVE-2010-3847 affects systems using GNU C Library versions through 2.11.2 and specific 2.12.x versions up to 2.12.1.
Can CVE-2010-3847 be exploited remotely?
CVE-2010-3847 requires local access for exploitation since it involves manipulating environment variables.
What are the potential impacts of CVE-2010-3847?
Exploitation of CVE-2010-3847 can lead to local users gaining elevated privileges, compromising system security.