Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 5 Sep 2015 18:49:11 +0200
From: Hector Marco-Gisbert <>
Subject: CVE Request: Glibc Pointer guarding weakness


A weakness in the dynamic loader have been found, Glibc prior to 2.22.90 
are affected. The issue is that the LD_POINTER_GUARD in the environment 
is not sanitized allowing local attackers easily to bypass the pointer 
guarding protection on set-user-ID and set-group-ID programs.

Details and PoC at:

A patch is already sent to Glibc maintainers. This issue is similar to but now affect to dynamic 
linked applications.

Could you please assign a CVE ?

Hector Marco-Gisbert @
Cyber Security Researcher @
Universitat Politècnica de València (Spain)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ