CVE-2010-3856
glibc < 2.11.3 and 2.12.x < 2.12.2 - Privilege Escalation via LD_AUDIT Environment Variable
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2010-3856.
PoCs published by Metasploit, zx2c4, Tavis Ormandy, including Metasploit module exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.
AI-analyzed exploit summary This Metasploit module exploits CVE-2010-3856, a privilege escalation vulnerability in glibc's dynamic linker by abusing the LD_AUDIT environment variable to load arbitrary shared objects with elevated privileges. It leverages libpcprofile.so to create a root-owned file in a trusted library path, which is then overwritten with a malicious shared object for code execution.
Description
ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so.
Exploits (4)
This Metasploit module exploits CVE-2010-3856, a privilege escalation vulnerability in glibc's dynamic linker by abusing the LD_AUDIT environment variable to load arbitrary shared objects with elevated privileges. It leverages libpcprofile.so to create a root-owned file in a trusted library path, which is then overwritten with a malicious shared object for code execution.
This exploit leverages CVE-2010-3856 to achieve local privilege escalation by abusing the LD_AUDIT environment variable and libpcprofile.so to create a world-writable root-owned file, which is then replaced with a malicious shared library to spawn a root shell.
This exploit leverages CVE-2010-3856 in the GNU C library dynamic linker, where LD_AUDIT can load arbitrary DSOs with initialization routines executed as root. The PoC demonstrates privilege escalation by abusing libpcprofile.so to create a world-writable cron job file, leading to a root shell.
This Metasploit module exploits CVE-2010-3847, a privilege escalation vulnerability in glibc's dynamic linker. It abuses the LD_AUDIT environment variable to load arbitrary shared objects with elevated privileges, leveraging libpcprofile.so to achieve root access.