CVE-2017-16997

Priority
Low
Description
elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26
mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or
AT_SECURE) program, which allows local users to gain privileges via a
Trojan horse library in the current working directory, related to the
fillin_rpath and decompose_rpath functions. This is associated with
misinterpretion of an empty RPATH/RUNPATH token as the "./" directory.
NOTE: this configuration of RPATH/RUNPATH for a privileged program is
apparently very uncommon; most likely, no such program is shipped with any
common Linux distribution.
References
Bugs
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):needed
Ubuntu 14.04 LTS (Trusty Tahr):released (2.19-0ubuntu6.14)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 17.10 (Artful Aardvark):DNE
Ubuntu 18.04 LTS (Bionic Beaver):DNE
Ubuntu 18.10 (Cosmic Cuttlefish):DNE
Package
Source: glibc (LP Ubuntu Debian)
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 LTS (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (2.23-0ubuntu10)
Ubuntu 17.10 (Artful Aardvark):released (2.26-0ubuntu2.1)
Ubuntu 18.04 LTS (Bionic Beaver):needed
Ubuntu 18.10 (Cosmic Cuttlefish):needed
Patches:
Upstream:https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3e3c904daef69b8bf7d5cc07f793c9f07c3553ef (master)
Upstream:https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4ebd0c4191c6073cc8a7c5fdcf1d182c4719bcbb (release/2.26/master)
Upstream:https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f24c345bf5486cc8d659f7a17463adcae402ec8e (release/2.24/master)
More Information

Updated: 2018-06-26 04:12:03 UTC (commit 7799c934cca373482531a7b00e4dfe82302ceae5)