CVE-2015-8777
glibc: LD_POINTER_GUARD in the environment is not sanitized
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The process_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guarding protection mechanism via a zero value of the LD_POINTER_GUARD environment variable.
La función process_envvars en elf/rtld.c en la GNU C Library (también conocida como glibc o libc6) en versiones anteriores a 2.23 permite a usuarios locales eludir un mecanismo de protección de puntero a través de un valor cero de la variable de entorno LD_POINTER_GUARD.
It was found that the dynamic loader did not sanitize the LD_POINTER_GUARD environment variable. An attacker could use this flaw to bypass the pointer guarding protection on set-user-ID or set-group-ID programs to execute arbitrary code with the permissions of the user running the application.
Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain administrative privileges or expose sensitive information. Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite loop). Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-05-26 CVE Published
- 2016-01-19 CVE Reserved
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-254: 7PK - Security Features
CAPEC
References (17)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2016/01/20/1 | Mailing List |
|
| http://www.securityfocus.com/bid/81469 | Vdb Entry | |
| http://www.securitytracker.com/id/1034811 | Vdb Entry | |
| https://sourceware.org/bugzilla/show_bug.cgi?id=18928 | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| http://hmarco.org/bugs/glibc_ptr_mangle_weakness.html | 2024-08-06 |
| URL | Date | SRC |
|---|