Description
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | glibc 2.19 through 2.26 | glibc 2.19 through 2.26 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.25-6 | — |
| Debian 13 | glibc | 2.25-6 | — |
| Debian 12 | glibc | 2.25-6 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | glibc | 2.23-0ubuntu10 | USN-3534-1 |
| Ubuntu 14.04 LTS | eglibc | 2.19-0ubuntu6.14 | USN-3534-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | nscd +7 | 2.17-260.el7 | RHSA-2018:3092 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | glibc | 2.22-62.3.4 | SUSE-SU-2018:0074-1 |
| SLES 12 SP2 | glibc | 2.22-62.3.4 | SUSE-SU-2018:0074-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP3 | glibc | 2.22-62.3.4 | SUSE-SU-2018:0074-1 |
| SLES for SAP 12 SP2 | glibc | 2.22-62.3.4 | SUSE-SU-2018:0074-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | glibc | 2.34-1.2 | openSUSE-SU-2024:10792-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | nscd +6 | 2.17-260.0.9.el7 | ELSA-2018-3092 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Xiami2012/CVE-2017-16997-poc ★ 0 · Jan 3, 2018
A proof-of-concept for CVE-2017-16997
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2018:3092 Red Hat Security Advisory: glibc security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-3534-1 eglibc, glibc vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10792-1 glibc-2.34-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0074-1 Security update for glibc SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1478 GNU libc: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 2, 2024
- ELSA-2018-3092 Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 5, 2018
References
- https://sourceware.org/bugzilla/show_bug.cgi?id=22625
- 102228 vdb-entry
- https://sourceware.org/ml/libc-alpha/2017-12/msg00528.html
- https://bugs.debian.org/884615
- RHSA-2018:3092 vendor-advisory
- RHBA-2019:0327 vendor-advisory