This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 645672 - (CVE-2010-3856) CVE-2010-3856 glibc: ld.so arbitrary DSO loading via LD_AUDIT in setuid/setgid programs
CVE-2010-3856 glibc: ld.so arbitrary DSO loading via LD_AUDIT in setuid/setgi...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
public=20101022,reported=20101021,sou...
: Security
Depends On: 645677 645678 645679 645680 645875
Blocks:
  Show dependency treegraph
 
Reported: 2010-10-22 04:28 EDT by Petr Matousek
Modified: 2016-02-04 01:48 EST (History)
15 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-11-11 03:12:40 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Petr Matousek 2010-10-22 04:28:34 EDT
Tavis Ormandy pointed out that glibc does not properly sanitize DSOs that
are loaded using LD_AUDIT facility. Tavis quoted:

  In order to be preloaded during the execution of a privileged program, a
  library must be setuid and in the trusted library search path. This is a
  reasonable design, in order to be loaded a system administrator must brand
  a library as safe before it will be loaded across privilege boundaries.

  This allows developers who design their programs to operate safely while
  running as setuid are able to do so. The same conditions do not apply to
  LD_AUDIT, which will load an arbitrary DSOs, regardless of whether it
  has been designed to operate safely or not.

Tavis found out that by exploiting unsafely designed DSO constructors in
trusted directories it is possible to achieve privilege escalation.

Acknowledgements:

Red Hat would like to thank Ben Hawkes and Tavis Ormandy for reporting this issue.
Comment 12 Petr Matousek 2010-10-22 13:02:38 EDT
Reference:

http://seclists.org/fulldisclosure/2010/Oct/344
Comment 13 Petr Matousek 2010-10-22 14:05:31 EDT
Created glibc tracking bugs for this issue

Affects: fedora-all [bug 645875]
Comment 14 Roberto Yokota 2010-10-22 14:07:56 EDT
Andreas Patch:

http://sourceware.org/ml/libc-hacker/2010-10/msg00010.html

Thanks,

Roberto Yokota
Comment 15 Petr Matousek 2010-10-23 05:40:32 EDT
This issue did not affect the versions of glibc package as shipped with Red Hat Enterprise Linux 3 and 4 as these do not implement Auditing API for the dynamic linker.
Comment 18 errata-xmlrpc 2010-10-25 14:54:32 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0793 https://rhn.redhat.com/errata/RHSA-2010-0793.html
Comment 19 errata-xmlrpc 2010-11-10 13:57:35 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2010:0872 https://rhn.redhat.com/errata/RHSA-2010-0872.html

Note You need to log in before you can comment on or make changes to this bug.