A vulnerability has been identified in the standard C library Glibc (CVE-2025-4802), allowing for code execution with the privileges of another user granted when running applications with the suid flag. The threat is mitigated by the conditions under which it manifests—Glouc developers could not find a single suid program to which the vulnerability would apply. However, it is possible that custom suid programs satisfying the attack conditions may be in use.
Exploitation of the vulnerability is only possible for statically compiled suid programs that invoke the dlopen function. In addition to programs that directly call dlopen, the vulnerability also affects programs where the dlopen function is indirectly invoked as a result of setlocale or NSS functions like getaddrinfo.
The issue is caused by the handling of the LD_LIBRARY_PATH environment variable in the context of suid applications when invoking dlopen from statically compiled programs (the LD_LIBRARY_PATH was ignored only during dynamic linking). By setting a path in LD_LIBRARY_PATH, an attacker can arrange to load a replacement library from their directory. The vulnerability appears starting from Glibc version 2.27 (February 2018) and is fixed in Glibc release 2.39 (February 2024).
Źródło: opennet.ru
