Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-4802. PoCs published by Betim-Hodza.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2025-4802, demonstrating privilege escalation via untrusted LD_LIBRARY_PATH in statically compiled setuid binaries that call dlopen(). The exploit includes a legitimate shared object, a malicious shared object that spawns a root shell, and a vulnerable setuid binary to demonstrate the attack.
Description
Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
Exploits (1)
This repository contains a functional proof-of-concept exploit for CVE-2025-4802, demonstrating privilege escalation via untrusted LD_LIBRARY_PATH in statically compiled setuid binaries that call dlopen(). The exploit includes a legitimate shared object, a malicious shared object that spawns a root shell, and a vulnerable setuid binary to demonstrate the attack.
References (5)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H