The ld.so loader is responsible for finding and loading shared library dependencies for executables at runtime. The vulnerability specifically exists in ld.so's handling of the GLIBC_TUNABLES environment variable, which configures tuning parameters for glibc. By supplying a malformed GLIBC_TUNABLES value, attackers can trigger a buffer overflow and corrupt memory.
The vulnerability was introduced in glibc version 2.34 released in April 2021. The Qualys researchers discovered that by overwriting a specific function pointer in memory, they could control the ld.so loader's library search path and force it to load a malicious shared library under their control.
This library can then execute arbitrary code with the privileges of any setuid or setgid binary on the system.
The proof-of-concept exploit developed by Qualys was able to reliably gain root privileges on default installations of Fedora, Ubuntu, Debian, and other major distributions. The attack is made more reliable by exhaustively brute-forcing the randomized stack address to increase the chances of controlling code execution.
According to the researchers, this vulnerability is easily exploitable and they expect public exploit code to be developed soon after disclosure. Any Linux distribution running glibc version 2.34 or later should be considered vulnerable.
"Our successful exploitation, leading to full root privileges on major distributions like Fedora, Ubuntu, and Debian, highlights this vulnerability’s severity and widespread nature," said Saeed Abbasi, Product Manager at Qualys' Threat Research Unit.
Qualys reported the bug to Red Hat Product Security on September 4, 2023. A patch is expected to be made available through distribution repositories once glibc is updated.
As a temporary mitigation, administrators can set the GLIBC_TUNABLES variable to a known good value to prevent exploitability. However, the only robust solution is to update glibc once patches are released.
The vulnerability is triggered when processing the GLIBC_TUNABLES environment variable on default installations of Debian 12 and 13, Ubuntu 22.04 and 23.04, and Fedora 37 and 38 (Alpine Linux, which uses musl libc, is not affected).
"A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable," a Red Hat advisory explains.
The ease of developing a working exploit combined with the ability to gain root makes this a critical severity issue that should be addressed immediately.
This vulnerability underscores the fragility of the Linux dynamic loader design and how exposed setuid binaries are to privilege escalation bugs. We will provide further analysis of the technical details and exploit mechanisms as more information is made public by Qualys after today's coordinated disclosure date.