CVE-2017-16997 Privilege escalation in glibc 2.19 through 2.26
Local attackers can gain privileges via Trojan horse libraries in privileged programs with specific RPATH configurations in glibc.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-16997?
CVE-2017-16997 is a high-severity vulnerability in Gnu Glibc, published on 18 Dec 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the "./" directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.
Weakness: CWE-426
Which versions are affected by CVE-2017-16997?
It affects 4 products.
Products include Gnu Glibc, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2017-16997?
Apply the vendor's patch.
Is CVE-2017-16997 being exploited?
There is no known exploitation of CVE-2017-16997 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Gnu Glibc
Sources
Also known as DEBIAN-CVE-2017-16997, GHSA-q5m3-4jcg-c4rf, UBUNTU-CVE-2017-16997.