A critical vulnerability in the GNU C library (glibc) could expose millions of Linux systems to local privilege escalation.
See also: Tor Oniux anonymizes network traffic of Linux applications
This vulnerability, identified as CVE-2025-4802 and publicly disclosed on May 16, 2025 , could allow attackers to execute arbitrary code via manipulation of the LD_LIBRARY_PATH environment variable . Systems running Rocky Linux, Debian, Ubuntu , and other major Linux distributions with glibc versions 2.27 to 2.38 may be affected by the vulnerability.
The issue is found in statically linked setuid binaries that call the dlopen(), either directly or indirectly through common functions such as setlocale() or NSS (Network Security Services) functions such as getaddrinfo().
Normally, setuid binaries ignore environment variables such as LD_LIBRARY_PATH for security reasons , however this vulnerability bypasses this protection mechanism .
The vulnerability was introduced in 2017 via commit 10e93d968716ab82931d593bada121c17c0a4b93 and was fixed in January 2023 with commit 5451fa962cd0a90a0e2ec1d8910a559ace02bba0, which was integrated into glibc version 2.39.
See also: Hackers are now testing ClickFix attacks against Linux
Security researcher Solar Designer developed and published a test example that demonstrates the existence of the vulnerability:
When this code is compiled into a shared library and placed in a folder declared via the LD_LIBRARY_PATH, it can be loaded by vulnerable programs, potentially allowing arbitrary code to be executed with elevated privileges.
Although the security advisory states that "at the time of publication, no directly affected programs have been identified," the vulnerability remains concerning, as custom setuid programs—while considered a security bad practice—are common in corporate environments.
This makes this bug a low-probability but high-impact vulnerability, especially in environments with old or custom statically compiled binaries.
See also: Malicious Go Modules Spread Disk-Wiping Linux Malware
To mitigate the risk associated with the CVE-2025-4802 vulnerability on Linux systems, the most important measure is to upgrade the GNU C library (glibc) to version 2.39 or later, where the issue has been fixed. In addition, it is critical to limit or eliminate the use of setuid binaries, especially when they are statically compiled and use the dlopen() either directly or through others such as setlocale() or getaddrinfo(). The LD_LIBRARY_PATH should be controlled and restrictedso that it cannot be set or used in environments with elevated privileges, especially on production or multi-user systems. In environments where this is not possible, monitoring actions through event logging (audit logs) and systematically checking for changes to critical variables such as LD_LIBRARY_PATH are essential for early detection of malicious activity.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
