Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
ld.so in the GNU C Library (aka glibc or libc6) 2.13 and earlier expands the $ORIGIN dynamic string token when RPATH is composed entirely of this token, which might allow local users to gain privileges by creating a hard link in an arbitrary directory to a (1) setuid or (2) setgid program with this RPATH value, and then executing the program with a crafted value for the LD_PRELOAD environment variable, a different vulnerability than CVE-2010-3847 and CVE-2011-0536. NOTE: it is not expected that any standard operating-system distribution would ship an applicable setuid or setgid program.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
GNU C Library ld.so本地权限提升漏洞
Vulnerability Description
glibc（又名GNU C Library，libc6）是一种按照LGPL许可协议发布的开源免费的C语言编译程序。 当RPATH完全由$ORIGIN动态字符串令牌组成时，GNU C Library（又名glibc或者libc6）2.13及之前版本中的ld.so扩展了该令牌。本地用户可以通过在带有RPATH值的（1）setuid或者（2）setgid程序的任意目录中创建硬链接，从而获取特权。
CVSS Information
N/A
Vulnerability Type
N/A