Description
Integer overflow in the process_envvars function in elf/rtld.c in glibc before 2.5-rc4 might allow local users to execute arbitrary code via a large LD_HWCAP_MASK environment variable value. NOTE: the glibc maintainers state that they do not believe that this issue is exploitable for code execution
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.6-2 | — |
| Debian 13 | glibc | 2.6-2 | — |
| Debian 12 | glibc | 2.6-2 | — |
References
- 24758 vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=183844
- [libc-hacker] [PATCH] Fix LD_HWCAP_MASK handling mailing-list
- ADV-2007-2418 vdb-entry
- glibc-envvars-overflow(35240) vdb-entry
- 37901 vdb-entry
- 1018334 vdb-entry
- 25864 third-party-advisory
- GLSA-200707-04 vendor-advisory
- http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/glibc/2.5/1600_all_glibc-hwcap-mask-secure.patch?rev=1.1&view=markup