CVE-2009-4147
FreeBSD 7.1-8.0 - Privilege Escalation
Title source: llmDescription
The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the (1) LD_LIBMAP, (2) LD_LIBRARY_PATH, (3) LD_LIBMAP_DISABLE, (4) LD_DEBUG, and (5) LD_ELF_HINTS_PATH environment variables, which allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library, different vectors than CVE-2009-4146.
Exploits (2)
metasploit
WORKING POC
EXCELLENT
by Kingcope, stealth, bcoles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/local/rtld_execl_priv_esc.rb
References (7)
Scores
EPSS
0.1258
EPSS Percentile
94.0%
Details
CWE
CWE-264
Status
published
Products (2)
freebsd/freebsd
7.1
freebsd/freebsd
8.0
Published
Dec 02, 2009
Tracked Since
Feb 18, 2026