Vulnerability Note VU#537223

GNU C library dynamic linker expands $ORIGIN in setuid library search path

Original Release date: 25 Oct 2010 | Last revised: 26 Oct 2010

Overview

Certain versions of glibc unsafely handle the $ORIGIN ELF substitution sequence which can be exploited to gain local privilege escalation.

Description

Tavis Ormandy's advisory states:

"$ORIGIN is an ELF substitution sequence representing the location of the executable being loaded in the filesystem hierarchy. The intention is to allow executables to specify a search path for libraries that is relative to their location, to simplify packaging without spamming the standard search paths with single-use libraries."
...
"$ORIGIN is only expanded if it is alone and first in the path. This makes little sense, and does not appear to be useful even if there were no security impact. This was most likely the result of an attempt to re-use the existing DT_NEEDED resolution infrastructure for LD_AUDIT support, accidentally introducing this error. Perhaps surprisingly, this error is exploitable."

Versions 2.12.1 on Fedora Core 13 and 2.5 on RHEL5 and CENTOS5 are known to be affected. Other versions and Linux distributions are probably affected but have not been confirmed at this time.

Full details are available in Tavis Ormandy's advisory.

Impact

A local unprivileged attacker can escalate their privileges to root.

Solution

Apply an update for the glibc packages from distribution vendors.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
CentOSAffected-25 Oct 2010
Debian GNU/LinuxAffected-26 Oct 2010
Fedora ProjectAffected-25 Oct 2010
Mandriva S. A.Affected-26 Oct 2010
Red Hat, Inc.Affected-25 Oct 2010
Slackware Linux Inc.Affected-26 Oct 2010
UbuntuAffected-26 Oct 2010
Gentoo LinuxUnknown-25 Oct 2010
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Tavis Ormandy for researching and publishing the details of this vulnerability.

This document was written by Jared Allar.

Other Information

  • CVE IDs: CVE-2010-3847
  • Date Public: 18 Oct 2010
  • Date First Published: 25 Oct 2010
  • Date Last Updated: 26 Oct 2010
  • Severity Metric: 13.36
  • Document Revision: 16

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.