CVE-2009-4147

FreeBSD 7.1-8.0 - Privilege Escalation

Title source: llm

Description

The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the (1) LD_LIBMAP, (2) LD_LIBRARY_PATH, (3) LD_LIBMAP_DISABLE, (4) LD_DEBUG, and (5) LD_ELF_HINTS_PATH environment variables, which allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library, different vectors than CVE-2009-4146.

Exploits (2)

exploitdb WORKING POC VERIFIED
by kingcope · textlocalbsd
https://www.exploit-db.com/exploits/10255
metasploit WORKING POC EXCELLENT
by Kingcope, stealth, bcoles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/local/rtld_execl_priv_esc.rb

Scores

EPSS 0.1258
EPSS Percentile 94.0%

Details

CWE
CWE-264
Status published
Products (2)
freebsd/freebsd 7.1
freebsd/freebsd 8.0
Published Dec 02, 2009
Tracked Since Feb 18, 2026