Loading story…
The GNU C Library project disclosed CVE-2025-4802, a local privilege-escalation flaw affecting glibc versions 2.27 through 2.38. The bug causes statically linked setuid/setgid ELF binaries that call dlopen()—directly or indirectly through functions such as setlocale, getaddrinfo, or other NSS-related paths—to incorrectly honor LD_LIBRARY_PATH in secure execution mode, allowing attacker-controlled libraries to be loaded and executed with elevated privileges. Upstream tracked the issue in advisory GLIBC-SA-2025-0002, describing it as locally exploitable and dependent on the presence of a privileged static binary that invokes dynamic loading.
Technical analysis traced the flaw to a 2017 glibc change that removed trusted-path enforcement during runtime path initialization, while the fix moved secure-mode environment sanitization earlier in _dl_non_dynamic_init() so variables such as LD_LIBRARY_PATH are cleared before library search paths are built; the correction landed upstream in glibc 2.39. Public writeups and mailing-list discussion included proof-of-concept exploitation using malicious NSS modules to achieve code execution as root or with SGID privileges, but both the advisory and follow-on analysis said practical exposure appears limited because no default-distribution binaries meeting the exploit conditions had been identified, though custom privileged programs remain at risk.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
In response to the advisory, Solar Designer posted a proof of concept showing a statically linked SGID test program loading a malicious NSS library from the current directory via LD_LIBRARY_PATH. He also reported that one hardened Rocky Linux 9.5 downstream glibc build blocked the SGID test despite lacking the exact upstream backport.
The GNU C Library project published security advisory GLIBC-SA-2025-0002 for CVE-2025-4802, warning that statically linked setuid binaries calling dlopen may incorrectly search LD_LIBRARY_PATH and execute attacker-controlled library code. The advisory said exploitation was only considered locally viable and that no vulnerable program had been identified at publication time.
glibc fixed the issue by moving secure-mode environment sanitization earlier in _dl_non_dynamic_init() so LD_LIBRARY_PATH and related variables are cleared before path initialization. The fix was implemented in commit 5451fa962cd0a90a0e2ec1d8910a559ace02bba0.
A glibc commit removed trusted-path enforcement from fillin_rpath(), allowing LD_LIBRARY_PATH to be processed in secure execution contexts for affected static privileged binaries. Later analyses identified this 2017 change as the root cause of CVE-2025-4802.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
allelesecurity.com
Open sourceallelesecurity.com
Open sourcesourceware.org
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The GNU C Library disclosed multiple security flaws affecting widely deployed versions of `glibc`, including two DNS-related bugs in `gethostbyaddr` and `gethostbyaddr_r` when the DNS backend is used through `nsswitch.conf`. Tracked as **CVE-2026-4437** and **CVE-2026-4438**, the issues affect versions **2.34 through 2.43** and stem from defects in the `getanswer_ptr` function. One flaw can cause `glibc` to treat a non-answer DNS section as valid and return the wrong hostname, enabling limited reverse-DNS obfuscation for attackers who are network-adjacent or control the DNS server. The other can return invalid DNS hostnames, including names containing shell metacharacters, creating a potential shell-injection path in applications that unsafely pass resolved hostnames to a shell.
Jun 29, 2026
The GNU C Library project disclosed two security flaws in `gethostbyaddr()` and `gethostbyaddr_r()` affecting glibc versions `2.34` through `2.43` when the DNS backend is enabled through `nsswitch.conf`, and shipped fixes in **glibc 2.44**. According to the published advisories, **CVE-2026-4437** can cause crafted DNS replies to treat non-answer sections as valid answers, potentially returning an incorrect hostname and enabling limited reverse-DNS obfuscation, while **CVE-2026-4438** may accept invalid DNS hostnames containing shell metacharacters, creating a potential shell-injection risk if an application later passes the hostname to a shell unsafely. The maintainers said exploitation would require a network-adjacent attacker or a compromised DNS server, and noted that no affected DNS servers or vulnerable applications were known at the time of disclosure. Release notes for **glibc 2.44** also tie the update to a third security fix, **CVE-2026-4046**, in `iconv()` handling of the `IBM1390` and `IBM1399` character sets, where malformed conversions could trigger incorrect processing or memory corruption under specific conditions.
Jul 27, 2026
Linux defenders are being urged to detect local privilege escalation through behavioral correlations rather than signatures for individual CVEs. Elastic’s framework combines endpoint and Auditd telemetry to identify unprivileged processes that reach UID 0 after executing from writable paths, invoking suspicious SUID/SGID binaries, manipulating user namespaces with `unshare`, abusing trusted helpers, or accessing privileged data. Testing covered 11 public proof-of-concept exploits and SUID misconfigurations, including page-cache corruption, D-Bus, namespace, and file-descriptor-theft techniques; the researchers caution that custom evasion-focused exploits may bypass coverage. The guidance follows active risk from page-cache vulnerabilities including **Copy Fail** (`CVE-2026-31431`), which is reported exploited in the wild and listed in CISA’s KEV catalog, and DirtyFrag. These flaws can modify cached readable files—including SUID binaries, `/usr/bin/su`, or `/etc/passwd`—to gain root, with suspicious socket, `splice()` and namespace activity providing detection opportunities. Defenders should patch affected kernels, consider restricting unprivileged user namespaces and relevant kernel modules after compatibility testing, and evict page cache after mitigation. They should also monitor `/proc/sys/fs/binfmt_misc` for new or changed handlers and attacker-controlled interpreters, as the `binfmt_misc` credentials flag can redirect a legitimate SUID program to a malicious handler that inherits root privileges without the handler carrying a SUID bit.
Sep 11, 2026