A standard C library Glibc has a vulnerability (CVE-2025-4802) that allows code execution with the privileges of another user set when launching applications with the suid flag. The danger of the problem is mitigated by the conditions under which it manifests — Glibc developers were unable to find a single suid program to which the discovered vulnerability could be applied. However, it is possible that custom suid programs meeting the conditions for an attack can be used in practice.
Exploitation of the vulnerability is possible only for statically compiled suid programs that call the dlopen function. In addition to programs that directly invoke dlopen, the vulnerability also affects programs in which the dlopen function is executed indirectly as a result of calling setlocale or NSS functions like getaddrinfo.
The problem arises from the handling of the LD_LIBRARY_PATH environment variable in the context of suid applications when dlopen is called from statically compiled programs (the LD_LIBRARY_PATH was ignored only in dynamic linking). By setting a path in LD_LIBRARY_PATH, an attacker can arrange for a malicious library to be loaded from their directory. The vulnerability manifests starting from Glibc version 2.27 (February 2018) and was fixed in Glibc version 2.39 (February 2024).
Forrás: opennet.ru
