CVE-2025-4802

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).(CVE-2025-4802)

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

• glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

• CVE-2025-4802: fix untrusted LD_LIBRARY_PATH vulnerability in dynamically shared library loading in setuid binaries

• CVE-2025-4802: fix untrusted LD_LIBRARY_PATH vulnerability in dynamically shared library loading in setuid binaries to prevent attacker control

• CVE-2025-4802: fix issue of untrusted LD_LIBRARY_PATH environment variable vulnerability by restricting loading of dynamically shared libraries in statically compiled setuid binaries

• SECURITY UPDATE: Untrusted LD_LIBRARY_PATH environment variable vulnerability
  • debian/patches/any/CVE-2025-4802.patch: Ignore LD_LIBRARY_PATH and debug env var for setuid for static
  • CVE-2025-4802

• CVE-2025-4802: fix untrusted LD_LIBRARY_PATH environment variable vulnerability by properly sanitizing the dynamic shared library loading

• CVE-2025-4802: prevent untrusted LD_LIBRARY_PATH from loading dynamically shared libraries in statically compiled binaries that call dlopen

• CVE-2025-4802: prevent untrusted LD_LIBRARY_PATH from loading dynamically shared libraries in statically compiled binaries that call dlopen

• CVE-2025-4802: prevent untrusted LD_LIBRARY_PATH from loading dynamically shared libraries in statically compiled binaries that call dlopen

• SECURITY UPDATE: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH
  • debian/patches/all/git-CVE-2025-4802-elf-Ignore-LD_LIBRARY_PATH-and-debug-env-var-for-setu.patch: elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static
  • CVE-2025-4802

An untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library versions 2.27 to 2.38 allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo). (CVE-2025-4802)

These are all security issues fixed in the glibc-2.41-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kumactl-2.12.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for glibc fixes the following issues:

• CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries using dlopen search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

This update for glibc fixes the following issues:

• CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries using dlopen search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

This update for glibc fixes the following issues:

Security issues fixed:

• CVE-2025-4802: possible execution of attacker controlled code when statically linked setuid binaries using dlopen search for libraries to load in LD_LIBRARY_PATH (bsc#1243317).

Other issues fixed:

• Multi-threaded application hang due to deadlock when pthread_cond_signal fails to wake up pthread_cond_wait as a consequence of a bug related to stealing of signals (bsc#1234128).

This update for glibc fixes the following issues:

• CVE-2025-4802: Fixed local root exploits when using static built setuid root applications. (elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static) (bsc#1243317)
• pthreads NPTL: lost wakeup fix 2 (bsc#1234128, BZ #25847)
• Mark functions in libc_nonshared.a as hidden (bsc#1239883)

This update for glibc fixes the following issues:

• CVE-2025-4802: elf: Ignore LD_LIBRARY_PATH and debug env var for setuid for static (bsc#1243317)
• pthreads NPTL: lost wakeup fix 2 (bsc#1234128, BZ #25847)
• Mark functions in libc_nonshared.a as hidden (bsc#1239883)
• Linux: Switch back to assembly syscall wrapper for prctl (bsc#1234665, BZ #29770)

It was discovered that the GNU C Library incorrectly search LD_LIBRARY_PATH to determine which library to load when statically linked setuid binary calls dlopen. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code.