{"uuid": "ee08c0d3-6c4e-42f3-9443-3899c0b0f18e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Tavis Ormandy\", \"zx2c4\", \"Marco Ivaldi\", \"Todor Donev\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module attempts to gain root privileges on Linux systems by abusing\\n          a vulnerability in the GNU C Library (glibc) dynamic linker.\\n\\n          glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not\\n          properly restrict use of the LD_AUDIT environment variable when loading\\n          setuid executables. This allows loading arbitrary shared objects from\\n          the trusted library search path with the privileges of the suid user.\\n\\n          This module uses LD_AUDIT to load the libpcprofile.so shared object,\\n          distributed with some versions of glibc, and leverages arbitrary file\\n          creation functionality in the library constructor to write a root-owned\\n          world-writable file to a system trusted search path (usually /lib).\\n          The file is then overwritten with a shared object then loaded with\\n          LD_AUDIT resulting in arbitrary code execution.\\n\\n          This module has been tested successfully on glibc version 2.11.1 on\\n          Ubuntu 10.04 x86_64 and version 2.7 on Debian 5.0.4 i386.\\n\\n          RHEL 5 is reportedly affected, but untested. Some glibc distributions\\n          do not contain the libpcprofile.so library required for successful\\n          exploitation.\", \"disclosure_date\": \"2010-10-18\", \"fullname\": \"exploit/linux/local/glibc_ld_audit_dso_load_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/glibc_ld_audit_dso_load_priv_esc\", \"references\": [\"CVE-2010-3847\", \"CVE-2010-3856\", \"BID-44154\", \"BID-44347\", \"EDB-15274\", \"EDB-15304\", \"EDB-18105\", \"URL-https://seclists.org/fulldisclosure/2010/Oct/257\", \"URL-https://seclists.org/fulldisclosure/2010/Oct/344\", \"URL-https://www.ubuntu.com/usn/usn-1009-1\", \"URL-https://security-tracker.debian.org/tracker/CVE-2010-3847\", \"URL-https://security-tracker.debian.org/tracker/CVE-2010-3856\", \"URL-https://access.redhat.com/security/cve/CVE-2010-3847\", \"URL-https://access.redhat.com/security/cve/CVE-2010-3856\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Automatic\", \"Linux x86\", \"Linux x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:08.255944Z"}