Description
On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected products
- Canonical / Ubuntu Linux19.10 – 19.10
- Canonical / Ubuntu Linux16.04 – 16.04
- Canonical / Ubuntu Linux18.04 – 18.04
- Debian / debian_linux10.0 – 10.0
- fedoraproject / fedora30 – 30
- fedoraproject / fedora31 – 31
- gnu / glibc2.31
References
- MISChttps://sourceware.org/bugzilla/show_bug.cgi?id=25204
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZFJ5E7NWOL6ROE5QVICHKIOUGCPFJVUH/
- MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FQ5LC6JOYSOYFPRUZ4S45KL6IP3RPPZ/
- VENDOR_ADVISORYhttps://usn.ubuntu.com/4416-1/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
Updated 44m ago · 8 sources