CVE-2009-4146

FreeBSD 7.1-8.0 - Privilege Escalation

Title source: llm

Description

The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1, 7.2, and 8.0 does not clear the LD_PRELOAD environment variable, which allows local users to gain privileges by executing a setuid or setguid program with a modified LD_PRELOAD variable containing an untrusted search path that points to a Trojan horse library, a different vector than CVE-2009-4147.

Exploits (2)

exploitdb WORKING POC
localbsd
https://www.exploit-db.com/exploits/10255
metasploit WORKING POC EXCELLENT
by Kingcope, stealth, bcoles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/local/rtld_execl_priv_esc.rb

Scores

EPSS 0.1817
EPSS Percentile 95.2%

Details

CWE
CWE-264
Status published
Products (3)
freebsd/freebsd 7.1
freebsd/freebsd 7.2
freebsd/freebsd 8.0
Published Dec 02, 2009
Tracked Since Feb 18, 2026