CVE-2019-19726

OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting a very small RLIMIT_DATA resource limit. When executing chpass or passwd (which are setuid root), _dl_setup_env in ld.so tries to strip LD_LIBRARY_PATH from the environment, but fails when it cannot allocate memory. Thus, the attacker is able to execute their own library code as root.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

3.52% chance of exploitation in the next 30 days, 88th percentile

Published

2019-12-12

Updated

2024-08-05

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/155658/Qualys-Security-Advisory-OpenBSD-Dynamic-Load…
• http://seclists.org/fulldisclosure/2019/Dec/31
• https://seclists.org/bugtraq/2019/Dec/25

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/openbsd/local/dynamic_loader_chp…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/47803
• https://www.exploit-db.com/exploits/47780

References

• CVE Record
• NVD entry

Related

• CVE-2019-19719
• CVE-2019-19731
• CVE-2019-19708
• CVE-2019-19740
• CVE-2019-19699
• CVE-2019-19742