CVE-2019-19726
First published: Thu Dec 12 2019(Updated: )
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openbsd Openbsd | <=6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/155658/Qualys-Security-Advisory-OpenBSD-Dynamic-Loader-Privilege-Escalation.html
- http://packetstormsecurity.com/files/155764/OpenBSD-Dynamic-Loader-chpass-Privilege-Escalation.html
- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2019/Dec/31
- http://seclists.org/fulldisclosure/2023/Oct/11
- http://www.openwall.com/lists/oss-security/2023/10/03/2
- https://seclists.org/bugtraq/2019/Dec/25
- https://www.openbsd.org/errata66.html
- https://www.openwall.com/lists/oss-security/2019/12/11/9
Frequently Asked Questions
What is the vulnerability ID for this OpenBSD vulnerability?
The vulnerability ID for this OpenBSD vulnerability is CVE-2019-19726.
What is the severity score of CVE-2019-19726?
The severity score of CVE-2019-19726 is 7.8 (high).
How does the vulnerability allow local users to escalate to root?
The vulnerability allows local users to escalate to root by defeating a check for LD_LIBRARY_PATH in setuid programs through a small RLIMIT_DATA resource limit.
Which version of OpenBSD is affected by this vulnerability?
Version 6.6 of OpenBSD is affected by this vulnerability.
Are there any references available for this vulnerability?
Yes, there are references available for this vulnerability. You can find them at the following links: [link1], [link2], [link3].
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-api
- collector/nvd-index
- vendor/openbsd
- canonical/openbsd openbsd
- version/openbsd openbsd/6.6