CVE-2017-16997 — HIGH (7.8)

Vulnerability Description

elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Gnu	Glibc	2.19
Redhat	Enterprise Linux Desktop	7.0
Redhat	Enterprise Linux Server	7.0
Redhat	Enterprise Linux Workstation	7.0

Related Weaknesses (CWE)

CWE-426

References

http://www.securityfocus.com/bid/102228Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3092Third Party Advisory
https://bugs.debian.org/884615Issue TrackingMailing ListPatch
https://sourceware.org/bugzilla/show_bug.cgi?id=22625Issue TrackingPatchThird Party Advisory
https://sourceware.org/ml/libc-alpha/2017-12/msg00528.htmlIssue TrackingPatchThird Party Advisory
http://www.securityfocus.com/bid/102228Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHBA-2019:0327Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3092Third Party Advisory
https://bugs.debian.org/884615Issue TrackingMailing ListPatch
https://sourceware.org/bugzilla/show_bug.cgi?id=22625Issue TrackingPatchThird Party Advisory
https://sourceware.org/ml/libc-alpha/2017-12/msg00528.htmlIssue TrackingPatchThird Party Advisory

FAQ

What is CVE-2017-16997?

CVE-2017-16997 is a vulnerability with a CVSS score of 7.8 (HIGH). elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to ga...

How severe is CVE-2017-16997?

CVE-2017-16997 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-16997?

Check the references section above for vendor advisories and patch information. Affected products include: Gnu Glibc, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.