CVE-2019-1010023 Code injection in glibc
Attackers can execute arbitrary code and potentially escalate privileges by tricking users into running ldd on malicious ELF files in the GNU C Library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-1010023?
CVE-2019-1010023 is a medium-severity code injection vulnerability in Gnu Glibc, published on 15 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
Which versions are affected by CVE-2019-1010023?
It affects 1 product.
Products include Gnu Glibc.
How do I fix CVE-2019-1010023?
No fix published yet.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-1010023 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-1010023 exists.
Other vulnerabilities in Gnu Glibc
Sources
Also known as DEBIAN-CVE-2019-1010023, GHSA-x8wp-c333-hv92, MINI-j3rr-48mm-ch3f, MINI-jmmw-4597-rmjp, MINI-q79w-4948-65pp, ROOT-OS-DEBIAN-12-CVE-2019-1010023 and 2 more.