A vulnerability (CVE-2025-4802) has been discovered in the standard C library Glibc, allowing for code execution with the privileges of another user assigned when running applications with the suid flag. The danger of the issue is mitigated by the conditions under which it manifests — Glibc developers have not been able to find any suid programs to which the vulnerability would apply. However, it is possible that custom suid programs that meet the conditions for attack may be in use.
Exploitation of the vulnerability is only possible for statically compiled suid programs that call the dlopen function. In addition to programs that directly call dlopen, the vulnerability also affects programs in which the dlopen function is invoked indirectly, as a result of calling setlocale or NSS functions, such as getaddrinfo.
The issue is caused by the handling of the LD_LIBRARY_PATH environment variable in the context of suid applications when calling dlopen from statically compiled programs (the LD_LIBRARY_PATH was ignored only with dynamic linking). By setting a path in LD_LIBRARY_PATH, an attacker can orchestrate the loading of a malicious library from their directory. The vulnerability manifests starting from Glibc version 2.27 (February 2018) and was addressed in the release of Glibc 2.39 (February 2024).
Source: opennet.ru
