CVE-2010-3847 Privilege escalation in n/a

Medium 6.9 Published 7 Jan 2011 Updated 7 Aug 2024

Local attackers can gain privileges by exploiting improper handling of the LD_AUDIT environment variable in the GNU C Library dynamic linker.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2010-3847?

CVE-2010-3847 is a medium-severity vulnerability in Gnu Glibc, published on 7 Jan 2011. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory.

Weakness: CWE-59

Which versions are affected by CVE-2010-3847?

It affects 1 product.

Linux distribution packages (16)

`glibc` Red Hat:enterprise_linux:5::client	All versions	`0:2.5-49.el5_5.6`
`glibc-common` Red Hat:enterprise_linux:5::client	All versions	`0:2.5-49.el5_5.6`
`glibc-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:2.5-49.el5_5.6`
`glibc-debuginfo-common` Red Hat:enterprise_linux:5::client	All versions	`0:2.5-49.el5_5.6`
`glibc-devel` Red Hat:enterprise_linux:5::client	All versions	`0:2.5-49.el5_5.6`
`glibc-headers` Red Hat:enterprise_linux:5::client	All versions	`0:2.5-49.el5_5.6`
`glibc-utils` Red Hat:enterprise_linux:5::client	All versions	`0:2.5-49.el5_5.6`
`nscd` Red Hat:enterprise_linux:5::client	All versions	`0:2.5-49.el5_5.6`
`glibc` Red Hat:enterprise_linux:5::server	All versions	`0:2.5-49.el5_5.6`
`glibc-common` Red Hat:enterprise_linux:5::server	All versions	`0:2.5-49.el5_5.6`
`glibc-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:2.5-49.el5_5.6`
`glibc-debuginfo-common` Red Hat:enterprise_linux:5::server	All versions	`0:2.5-49.el5_5.6`
`glibc-devel` Red Hat:enterprise_linux:5::server	All versions	`0:2.5-49.el5_5.6`
`glibc-headers` Red Hat:enterprise_linux:5::server	All versions	`0:2.5-49.el5_5.6`
`glibc-utils` Red Hat:enterprise_linux:5::server	All versions	`0:2.5-49.el5_5.6`
`nscd` Red Hat:enterprise_linux:5::server	All versions	`0:2.5-49.el5_5.6`

Products include Gnu Glibc.

How do I fix CVE-2010-3847?

Apply the vendor's patch.

Is CVE-2010-3847 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-3847 exists.

Public exploit code: 2 Metasploit modules, 6 Exploit-DB entries and 1 proofs of concept on GitHub.

All Gnu Glibc vulnerabilities

Sources

Also known as DEBIAN-CVE-2010-3847, GHSA-q3fw-v7x4-w8hh, RHSA-2010:0787.