CVE: CVE-2025-4802
The GNU C Library versions 2.27 to 2.38 have a vulnerability related to the untrusted LD_LIBRARY_PATH environment variable. This allows an attacker to control the loading of dynamically shared libraries in statically compiled setuid binaries that utilize dlopen. This can lead to significant security risks, including unauthorized access and manipulation of sensitive data.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-4802 |
Exploitation
To exploit this vulnerability, an attacker must manipulate the LD_LIBRARY_PATH environment variable to point to a malicious shared library. This can be done by setting the variable in a local environment before executing a vulnerable setuid binary that calls dlopen. The attacker must ensure that the malicious library is accessible and can be loaded by the binary.
Affected Products
- GNU C Library 2.27 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.28 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.29 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.30 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.31 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.32 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.33 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.34 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.35 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.36 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.37 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
- GNU C Library 2.38 – Vulnerable to the untrusted LD_LIBRARY_PATH issue.
Mitigation
To mitigate this vulnerability, it is recommended to avoid using the LD_LIBRARY_PATH environment variable in setuid binaries. Additionally, updating to a patched version of the GNU C Library that addresses this vulnerability is crucial. Implementing strict controls on environment variables and using secure coding practices can also help prevent exploitation.
References