Description
elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.11.2-8 | — |
| Debian 13 | glibc | 2.11.2-8 | — |
| Debian 12 | glibc | 2.11.2-8 | — |
| Debian 5.0 | glibc | 2.7-18lenny6 | DSA-2122-2, DSA-2122-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | nscd +6 | 2.12-1.7.el6_0.3 | RHSA-2010:0872 |
| RHEL 5 | nscd +6 | 2.5-49.el5_5.6 | RHSA-2010:0787 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
glibc '$ORIGIN' Expansion Privilege Escalation
exploit/linux/local/glibc_origin_expansion_priv_esc
-
glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation
exploit/linux/local/glibc_ld_audit_dso_load_priv_esc
Exploit-DB 4
- glibc - '$ORIGIN' Expansion Privilege Escalation (Metasploit) EDB-44024 · local · Feb 12, 2018 · verified
- glibc - 'LD_AUDIT' Arbitrary DSO Load Privilege Escalation (Metasploit) EDB-44025 · local · Feb 12, 2018 · verified
- GNU C Library 2.x (libc6) - Dynamic Linker LD_AUDIT Arbitrary DSO Load Privilege Escalation EDB-15304 · local · Oct 22, 2010 · verified
- GNU C library dynamic linker - '$ORIGIN' Expansion EDB-15274 · local · Oct 18, 2010 · verified
GitHub 1 repository
-
magisterquis/cve-2010-3847 ★ 0 · Jan 2, 2017
Script to take advantage of CVE-2010-3847
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2010:0872 Red Hat Security Advisory: glibc security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0787 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2122-2 glibc - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2122-1 glibc - local privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-201011-01 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0001.html
- http://support.avaya.com/css/P8/documents/100120941
- 20101018 The GNU C library dynamic linker expands $ORIGIN in setuid library search path mailing-list
- RHSA-2010:0872 vendor-advisory
- SUSE-SA:2010:052 vendor-advisory
- MDVSA-2010:207 vendor-advisory
- 44025 exploit
- 44024 exploit
- DSA-2122 vendor-advisory
- USN-1009-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=643306
- 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap mailing-list
- RHSA-2010:0787 vendor-advisory
- 44154 vdb-entry
- 20101020 Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path mailing-list
- 42787 third-party-advisory
- ADV-2011-0025 vdb-entry
- [libc-hacker] 20101018 [PATCH] Never expand $ORIGIN in privileged programs mailing-list
- 20101019 Re: The GNU C library dynamic linker expands $ORIGIN in setuid library search path mailing-list
- VU#537223 third-party-advisory