Description
ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.11.2-8 | — |
| Debian 13 | glibc | 2.11.2-8 | — |
| Debian 12 | glibc | 2.11.2-8 | — |
| Debian 5.0 | glibc | 2.7-18lenny6 | DSA-2122-2, DSA-2122-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | nscd +6 | 2.12-1.7.el6_0.3 | RHSA-2010:0872 |
| RHEL 5 | nscd +6 | 2.5-49.el5_5.7 | RHSA-2010:0793 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation
exploit/linux/local/glibc_ld_audit_dso_load_priv_esc
Exploit-DB 3
- glibc - 'LD_AUDIT' Arbitrary DSO Load Privilege Escalation (Metasploit) EDB-44025 · local · Feb 12, 2018 · verified
- glibc - 'LD_AUDIT' Arbitrary DSO Load Privilege Escalation EDB-18105 · local · Nov 10, 2011 · verified
- GNU C Library 2.x (libc6) - Dynamic Linker LD_AUDIT Arbitrary DSO Load Privilege Escalation EDB-15304 · local · Oct 22, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2010:0872 Red Hat Security Advisory: glibc security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0793 Red Hat Security Advisory: glibc security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2122-2 glibc - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2122-1 glibc - local privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
- VDE-2019-013 WAGO: Multiple Vulnerabilities in industrial managed switches CERT@VDE · Jun 12, 2019
References
- 20101022 The GNU C library dynamic linker will dlopen arbitrary DSOs during setuid loads. mailing-list
- 44347 vdb-entry
- GLSA-201011-01 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2011-0001.html
- http://support.avaya.com/css/P8/documents/100121017
- https://bugzilla.redhat.com/show_bug.cgi?id=645672
- RHSA-2010:0872 vendor-advisory
- SUSE-SA:2010:052 vendor-advisory
- 44025 exploit
- DSA-2122 vendor-advisory
- USN-1009-1 vendor-advisory
- [libc-hacker] 20101022 [PATCH] Require suid bit on audit objects in privileged programs mailing-list
- 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap mailing-list
- MDVSA-2010:212 vendor-advisory
- 42787 third-party-advisory
- ADV-2011-0025 vdb-entry
- RHSA-2010:0793 vendor-advisory
- 20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series mailing-list
- 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series mailing-list
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
- http://www.openwall.com/lists/oss-security/2023/07/19/9
- http://seclists.org/fulldisclosure/2023/Jul/31
- http://www.openwall.com/lists/oss-security/2023/07/20/1
- http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html