CVE-2011-1658: Low severity gnu c library vulnerability
ld.so in the GNU C Library (aka glibc or libc6) 2.13 and earlier expands the $ORIGIN dynamic string token when RPATH is composed entirely of this token, which might allow local users to gain privileges by creating a hard link in an arbitrary directory to a (1) setuid or (2) setgid program with this RPATH value, and then executing the program with a crafted value for the LDPRELOAD environment variable, a different vulnerability than CVE-2010-3847 and CVE-2011-0536. NOTE: it is not expected that any standard operating-system distribution would ship an applicable setuid or setgid program.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1658?
CVE-2011-1658 is considered a high severity vulnerability due to its potential for local privilege escalation.
How do I fix CVE-2011-1658?
To fix CVE-2011-1658, it is recommended to upgrade the GNU C Library to a version later than 2.13.
Who is affected by CVE-2011-1658?
CVE-2011-1658 affects users running GNU C Library versions 2.13 and earlier, particularly those using setuid or setgid programs.
What type of vulnerability is CVE-2011-1658?
CVE-2011-1658 is a local privilege escalation vulnerability that exploits the handling of the $ORIGIN dynamic string token.
When was CVE-2011-1658 discovered?
CVE-2011-1658 was publicly disclosed in 2011.