CVE-2010-3847
elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for...
- Published
- Jan 7, 2011
- Updated
- Aug 7, 2024
- Assigning CNA
- redhat
- Evidence observed
- Oct 18, 2010
Primary CVSS
nvd · CVSS 2.0
AV:L/AC:M/Au:N/C:C/I:C/A:CLow · next 30 days
- Percentile
- 95.3%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory.
Sources
modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux($.exploit_linux/local/glibc_ld_audit_dso_load_priv_esc.platform)
- verification: check_declared($.exploit_linux/local/glibc_ld_audit_dso_load_priv_esc.check)
modules/exploits/linux/local/glibc_origin_expansion_priv_esc.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux($.exploit_linux/local/glibc_origin_expansion_priv_esc.platform)
- verification: check_declared($.exploit_linux/local/glibc_origin_expansion_priv_esc.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.