Glibc Dynamic Loader Hit By A Nasty Local Privilege Escalation Vulnerability

[phoronix]

Phoronix: Glibc Dynamic Loader Hit By A Nasty Local Privilege Escalation Vulnerability

A nasty vulnerability has been made public today concerning Glibc's dynamic loader that can lead to full root privileges being obtained by local users. This affects Linux distributions of the past two years with the likes of Ubuntu 22.04 LTS, 23.04, Fedora 38, and others vulnerable to this local privilege escalation issue...

https://www.phoronix.com/news/Glibc-LD-Nasty-Root-Bug

[aviallon]

Love the picture. I wonder what socket this is.

I wonder if this could be easily combined with a browser exploit to make a very nasty attack vector.

[S.Pam]

So ,are all glibc >=2.34 vulnerable? The last part of the linked mailing list entry makes it unclear?

Last-minute note: although glibc 2.34 is vulnerable to this buffer
overflow, its tunables_strdup() uses __sbrk(), not __minimal_malloc()
(which was introduced in glibc 2.35 by commit b05fae, "elf: Use the
minimal malloc on tunables_strdup"); we have not yet investigated
whether glibc 2.34 is exploitable or not.

[bug77]

So ,are all glibc >=2.34 vulnerable? The last part of the linked mailing list entry makes it unclear?

I just tested it with the latest (2.38) and it still provoked that core dump. So yes.

[Serafean]

Love the picture. I wonder what socket this is.

abit aw9d-MAX motherboard, LGA 775 socket.

[andyprough]

Open the bottle Michael. But do it on a running system. And benchmark it for us.

[Michael]

Love the picture. I wonder what socket this is.

https://www.phoronix.com/review/854

[timofonic]

I did read there was an important ncurses vulnerability too...

https://www.microsoft.com/en-us/security/blog/2023/09/14/uncursing-the-ncurses-memory-corruption-vulnerabilities-found-in-library/

https://thehackernews.com/2023/09/microsoft-uncovers-flaws-in-ncurses.html?m=1

https://www.scmagazine.com/brief/linux-macos-systems-could-be-compromised-with-ncurses-library-bugs

No news here?

[docontra]

Good guy glibc, giving us all a reason to try out systemctl soft-reset

[npwx]

Looking at the code cited in the email, seriously, WTF? I'm not surprised they have security issues. Not a single helper functions for string parsing and manipulation, everything open coded while loops, checking *x for \0 etc. That looks like code from the 30 years ago, no wonder nobody spotted the bug in all that mess.