Executive brief
The Linux run-time linker, which is responsible for loading shared libraries when programs start, contains a flaw in how it handles error messages. A local user can exploit this by running a specially crafted program with an extremely long name to trigger a buffer overflow. If successful, this allows the attacker to gain full administrative (root) privileges on the system, potentially leading to a complete system takeover.
Technical details
A buffer overflow exists in the error reporting functions of the Linux run-time linkers (ld.so for a.out and ld-linux.so for ELF). The vulnerability is caused by the use of vsprintf (or a similar internal printf implementation) to format error messages into a fixed-size automatic (stack) buffer without bounds checking. An attacker can trigger this by executing a setuid binary with an excessively long argv[0] and forcing a linker error (e.g., through file descriptor exhaustion or library loading failures). This allows for a stack-based buffer overflow, enabling arbitrary code execution with the privileges of the setuid binary (typically root). The issue was addressed in ld.so version 1.9.5 and later.
Affected products
- Linux ld.so <= 1.9.2
- Linux ld-linux.so <= 1.9.2
Timeline
- 1997-07-16: disclosed: Initial advisory by KSR[T] released.
- 1997-07-17: advisory: NVD publication date.
- 1997-07-22: patched: Patched versions (1.9.3) and vendor updates announced.
- 1998-02-04: other: Public exploit code released by Nergal on Bugtraq.