CVE-2011-0536: Medium severity gnu c library vulnerability
Following patch was applied to glibc packages to address dynamic linker privilege escalation issue CVE-2010-3847 (see bug #643306):
https://bugzilla.redhat.com/showbug.cgi?id=CVE-2010-3847#c26 http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=4b646a51f13fd6816c483fb24c308a13264c6d1a
This change introduced a regression in handling of privileged programs that use $ORIGIN in RPATH in the binary itself, or any of the depending libraries. When running such privileged program, this issue causes dynamic linker to not expand $ORIGIN in RPATH and search for additional dynamic objects starting from the current working directory. This could allow a local user to escalate their privileges, or cause the program to fail to find required libraries.
Prior to the CVE-2010-3847, it was possible to escalate privileges when privileged program had $ORIGIN in RPATH. An attacker needed to have a write access to the file system hosting such binary, to be able to hard-link it to an attacker-controlled directory. Then the attacker could LDPRELOAD malicious library from the same directory and execute code with elevated privileges. This flaw was of limited risk, as setuid/setgid binaries with $ORIGIN in RPATH seem to be rare (there's no such binary in Red Hat Enterprise Linux).
With the 4b646a51 fix applied, attacker no longer needs write access to the file system with privileged program, and the relative-to-CWD search can be triggered by RPATHs of depending libraries too. Even with these loosened requirements, there are currently no privileged programs shipped with Red Hat Enterprise Linux known to be exploitable using this flaw.
To address this issue, 4b646a51 was reverted and the following patch was applied in fedora glibc git branch: http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=96611391ad8823ba58405325d78cefeae5cdf699
Following patch is also required to avoid regressing CVE-2010-3847 fix: https://bugzilla.redhat.com/showbug.cgi?id=CVE-2010-3847#c22 http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=22cd1c9bcf57c5829d65b6da825f7a459d40c9eb
Other sources
Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el55.6 and glibc-2.12-1.7.el60.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has $ORIGIN in (a) RPATH or (b) RUNPATH within the program itself or a referenced library. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0536?
CVE-2011-0536 is considered a moderate severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2011-0536?
To fix CVE-2011-0536, update to the patched versions of the glibc packages as recommended by your operating system vendor.
Which versions of glibc are affected by CVE-2011-0536?
CVE-2011-0536 affects glibc versions 2.5-49.el5_5.6 and 2.12-1.7.el6_0.3 on Red Hat Enterprise Linux.
What type of vulnerability is CVE-2011-0536?
CVE-2011-0536 is a privilege escalation vulnerability found in the dynamic linker of the glibc library.
What operating systems are impacted by CVE-2011-0536?
CVE-2011-0536 impacts Red Hat Enterprise Linux systems utilizing the vulnerable versions of the glibc library.