Dynamic Loader , which is part of OpenBSD, under certain conditions may allow -applications to leave the LD_LIBRARY_PATH environment variable and thus permit loading third-party code in the context of a process running with elevated privileges. Patches addressing the vulnerability are available for releases and . Binary patches () for amd64, i386, and arm64 platforms have already been put into production and should be available for download by the time this news is published.
The crux of the issue: during operation, ld.so first retrieves the value of the LD_LIBRARY_PATH environment variable, uses the _dl_split_path() function to convert it into an array of strings—paths to directories. If it is later determined that the current process is run as a SUID/SGID application, the created array and, in fact, the LD_LIBRARY_PATH variable are cleared. At the same time, if during the operation of _dl_split_path() it encounters a lack of memory (which is unlikely due to the explicit limit on the size of environment variables set at 256 kilobytes, but theoretically possible), the variable _dl_libpath will be assigned a value of NULL, and the subsequent check of this variable will cause it to skip the _dl_unsetenv("LD_LIBRARY_PATH") call.
The vulnerability was discovered by specialists , as well as issues. The security researchers who identified the vulnerability noted the promptness of the response: the patch was prepared and updates were released within three hours of notification by the OpenBSD project.
Supplement: The issue has been assigned the number . An official announcement was made on the oss-security mailing list amd64 and i386 (the exploit can also be adapted for other architectures).
The problem can be exploited in a default installation and allows an unprivileged local user to execute code with root permissions through library substitution when running the SUID utilities chpass or passwd. To create the necessary conditions for exploitation, memory shortage is utilized by setting the RLIMIT_DATA limit via setrlimit.
The dynamic loader ld.so, which is part of OpenBSD, under certain conditions may allow
Source: opennet.ru
