CVE: CVE-2025-4802
The GNU C Library versions 2.27 to 2.38 have a vulnerability related to the untrusted LD_LIBRARY_PATH environment variable. This allows an attacker to control the loading of dynamically shared libraries in statically compiled setuid binaries that utilize dlopen. This can lead to significant security risks, including unauthorized access and execution of malicious code.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-4802 |
Exploitation
To exploit this vulnerability, an attacker must manipulate the LD_LIBRARY_PATH environment variable to point to a malicious shared library. This can be done by setting the variable in a local environment before executing a vulnerable setuid binary that calls dlopen. The attacker must ensure that the malicious library is loaded in place of the intended library, which can lead to arbitrary code execution.
Affected Products
- GNU C Library 2.27 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.28 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.29 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.30 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.31 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.32 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.33 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.34 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.35 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.36 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.37 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.38 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
Mitigation
To mitigate this vulnerability, it is recommended to avoid using setuid binaries that rely on the LD_LIBRARY_PATH environment variable. Additionally, users should ensure that their systems are updated to the latest version of the GNU C Library, where this vulnerability has been addressed. Implementing strict controls on environment variables and using secure coding practices can also help reduce the risk.
References