CVE-2006-6164 Privilege escalation in n/a
Local attackers can exploit improper environment variable handling in the ELF loader to inject LD_PRELOAD and gain elevated privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2006-6164?
CVE-2006-6164 is a high-severity vulnerability in Openbsd Openbsd, published on 29 Nov 2006. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The _dl_unsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LD_PRELOAD to loading processes, which might be leveraged to gain privileges.
Which versions are affected by CVE-2006-6164?
It affects 1 product.
Products include Openbsd Openbsd.
How do I fix CVE-2006-6164?
No fix has been published for CVE-2006-6164 yet. Limit exposure of the affected software until one is available.
Is CVE-2006-6164 being exploited?
There is no known exploitation of CVE-2006-6164 in the wild and no public exploit code.
Other vulnerabilities in Openbsd Openbsd
Sources
Also known as GHSA-xq8r-c6vq-9553.