CVE-2009-4146
FreeBSD 7.1-8.0 - Privilege Escalation
Title source: llmDescription
The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1, 7.2, and 8.0 does not clear the LD_PRELOAD environment variable, which allows local users to gain privileges by executing a setuid or setguid program with a modified LD_PRELOAD variable containing an untrusted search path that points to a Trojan horse library, a different vector than CVE-2009-4147.
Exploits (2)
metasploit
WORKING POC
EXCELLENT
by Kingcope, stealth, bcoles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/local/rtld_execl_priv_esc.rb
References (8)
Scores
EPSS
0.1817
EPSS Percentile
95.2%
Details
CWE
CWE-264
Status
published
Products (3)
freebsd/freebsd
7.1
freebsd/freebsd
7.2
freebsd/freebsd
8.0
Published
Dec 02, 2009
Tracked Since
Feb 18, 2026