Description
The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1, 7.2, and 8.0 does not clear the LD_PRELOAD environment variable, which allows local users to gain privileges by executing a setuid or setguid program with a modified LD_PRELOAD variable containing an untrusted search path that points to a Trojan horse library, a different vector than CVE-2009-4147.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
FreeBSD rtld execl() Privilege Escalation
exploit/freebsd/local/rtld_execl_priv_esc
Exploit-DB 1
- FreeBSD 8.0 Run-Time Link-Editor (RTLD) - Local Privilege Escalation EDB-10255 · local · Nov 30, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 37154 vdb-entry
- 20091201 Upcoming FreeBSD Security Advisory mailing-list
- 37517 third-party-advisory
- http://people.freebsd.org/~cperciva/rtld.patch
- 20091130 ** FreeBSD local r00t zeroday mailing-list
- 1023250 vdb-entry
- 20091201 Re: ** FreeBSD local r00t zeroday mailing-list
- http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html