CVE-2017-16997
published 2017-12-18CVE-2017-16997: elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or…
PriorityP338high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
2.70%
84.4th percentile
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.25-6 (bookworm) | glibc 2.25-6 (bookworm) |
| eglibc | eglibc | >= 0 < 2.19-0ubuntu6.14 | 2.19-0ubuntu6.14 |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | >= 0 < 2.25-6 | 2.25-6 |
| gnu | glibc | >= 0 < 2.25-6 | 2.25-6 |
| gnu | glibc | >= 0 < 2.25-6 | 2.25-6 |
| gnu | glibc | >= 0 < 2.25-6 | 2.25-6 |
| gnu | glibc | >= 0 < 2.23-0ubuntu10 | 2.23-0ubuntu10 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2018-01-17·CVSS 7.8
CVE-2017-1000408 [HIGH] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in the GNU C library.
It was discovered that the GNU C library did not properly handle all of
the possible return values from the kernel getcwd(2) syscall. A local
attacker could potentially exploit this to execute arbitrary code in setuid
programs and gain administrative privileges. (CVE-2018-1000001)
A memory leak was discovered in the _dl_init_paths() function in the GNU
C library dynamic loader. A local attacker could potentially exploit this
with a specially crafted value in the LD_HWCAP_MASK environment variable,
in combination with CVE-2017-1000409 and another vulnerability on a system
with hardlink protections disabled, in order to gain administrative
privileges. (CVE-2017-1000408)
A heap-based buf
Red Hat
glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries
vendor_redhat·2017-12-17·CVSS 7.8
CVE-2017-16997 [HIGH] CWE-470 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries
glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
Package: compat-glibc (Red Hat Enterprise Linux 5) - Will not fix
Package: glibc (Re
Debian
CVE-2017-16997: glibc - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishan...
vendor_debian·2017·CVSS 7.8
CVE-2017-16997 [HIGH] CVE-2017-16997: glibc - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishan...
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
Scope: local
bookworm: resolved (fixed in 2.25-6)
bullseye: resolved (fixed in 2.25-6)
forky: resolved (fixed in 2.25-6)
sid: resolved (fixed in 2.25-6)
trixie: resolved (fixed in 2.25-6)
GHSA
GHSA-q5m3-4jcg-c4rf: elf/dl-load
ghsa_unreviewed·2022-05-13
CVE-2017-16997 [HIGH] CWE-426 GHSA-q5m3-4jcg-c4rf: elf/dl-load
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
OSV
eglibc, glibc vulnerabilities
osv·2018-01-17·CVSS 7.8
CVE-2018-1000001 [HIGH] eglibc, glibc vulnerabilities
eglibc, glibc vulnerabilities
It was discovered that the GNU C library did not properly handle all of
the possible return values from the kernel getcwd(2) syscall. A local
attacker could potentially exploit this to execute arbitrary code in setuid
programs and gain administrative privileges. (CVE-2018-1000001)
A memory leak was discovered in the _dl_init_paths() function in the GNU
C library dynamic loader. A local attacker could potentially exploit this
with a specially crafted value in the LD_HWCAP_MASK environment variable,
in combination with CVE-2017-1000409 and another vulnerability on a system
with hardlink protections disabled, in order to gain administrative
privileges. (CVE-2017-1000408)
A heap-based buffer overflow was discovered in the _dl_init_paths()
function in the GNU C
OSV
CVE-2017-16997: elf/dl-load
osv·2017-12-18·CVSS 7.8
CVE-2017-16997 [HIGH] CVE-2017-16997: elf/dl-load
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
No detection rules found.
No public exploits indexed.
HackerOne
Container scanning and Dependency scanning report leaked to unauthorized users
hackerone·2019-12-13·CVSS 5.0
[MEDIUM] Container scanning and Dependency scanning report leaked to unauthorized users
Container scanning and Dependency scanning report leaked to unauthorized users
Hi GitLab Security team
### Summary
GitLab makes the container scanning and dependency scanning information available as part of a JSON endpoint for merge requests. These reports are output of the CI job and should only be displayed if the visiting user has access to CI. However, right now GitLab displays the the container scanning and dependency scanning reports regardless of this permission, making it available to whoever has access to the merge request.
For public projects, GitLab allows to restrict CI pipelines to project members only (public pipelines disabled). However, in this case, the merge request widget still renders the scanning reports result, which is the outcome of a CI pipeline.
### Steps to
Bugzilla
CVE-2017-16997 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries
bugzilla·2017-12-18·CVSS 7.8
CVE-2017-16997 [HIGH] CVE-2017-16997 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries
CVE-2017-16997 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries
Incorrect handling of RPATH (or RUNPATH) in elf/dl-load.c could be used to run executables with libraries loaded from the current directory. Executables with AT_SECURE or SETUID that contain '$ORIGIN' in RPATH/RUNPATH could be used to run arbitrary code and lead to escalation of privileges.
This vulnerability was introduced in glibc version 2.19.
References:
https://sourceware.org/bugzilla/show_bug.cgi?id=22625
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884615
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16997
Discussion:
Created glibc tracking bugs for this issue:
Affects: fedora-all [bug 1526866]
---
Fedora version of glibc carries th
Bugzilla
CVE-2017-16997 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries [fedora-all]
bugzilla·2017-12-18·CVSS 7.8
CVE-2017-16997 [HIGH] CVE-2017-16997 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries [fedora-all]
CVE-2017-16997 glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit
arXiv
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
arxiv_fulltext·2022-12-29
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
One Bad Apple Spoils the Barrel: Understanding the Security Risks Introduced by Third-Party Components in IoT Firmware
## Abstract
Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will influence the security of IoT firmware. Existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement , which leverages syntactical features and control-flow graph features to detect the TPCs in firmware, and then recognizes the corresponding vulnerabilities. Based on , we present the first l
arXiv
A Novel Model for Vulnerability Analysis through Enhanced Directed Graphs and Quantitative Metrics
arxiv_fulltext·2021-12-13
A Novel Model for Vulnerability Analysis through Enhanced Directed Graphs and Quantitative Metrics
A Novel Model for Vulnerability Analysis through Enhanced Directed Graphs and Quantitative Metrics
1st Ángel Longueira-Romero, 2nd Rosa Iglesias, 3rd Jose Luis Flores
Industrial Cybersecurity
Ikerlan Technology Research Centre (BRTA)
Arrasate/Mondragón, Spain
\alongueira, riglesias, jlflores\@ikerlan.es
4th Iñaki Garitano
Dept. of Electronics and Computing
Mondragon Unibertsitatea
Arrasate/Mondragón, Spain
[email protected]
## Abstract
Industrial components are of high importance because they control critical infrastructures that form the lifeline of modern societies.
However, the rapid evolution of industrial components, together with the new paradigm of Industry 4.0, and the new connectivity features that will be introduced by the 5G technology, all increase the likeliho
http://www.securityfocus.com/bid/102228https://access.redhat.com/errata/RHBA-2019:0327https://access.redhat.com/errata/RHSA-2018:3092https://bugs.debian.org/884615https://sourceware.org/bugzilla/show_bug.cgi?id=22625https://sourceware.org/ml/libc-alpha/2017-12/msg00528.htmlhttp://www.securityfocus.com/bid/102228https://access.redhat.com/errata/RHBA-2019:0327https://access.redhat.com/errata/RHSA-2018:3092https://bugs.debian.org/884615https://sourceware.org/bugzilla/show_bug.cgi?id=22625https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html
2017-12-18
Published