CVE-2009-5064

Vulnerability

The ldd utility in the GNU C Library (glibc) versions 2.13 and earlier acts as a wrapper that sets the LD_TRACE_LOADED_OBJECTS environment variable and invokes the dynamic linker/loader to display library dependencies. It omits certain security checks, allowing a crafted executable to execute arbitrary code when inspected by ldd. This behavior is inherent to how the dynamic linker processes binaries under LD_TRACE_LOADED_OBJECTS [1].

Exploitation

An attacker with local system access can create a malicious executable that exploits the omitted checks. When a victim (commonly a system administrator) runs ldd on this file, the executable's code is executed in the context of the dynamic linker, effectively running arbitrary code with the privileges of the user invoking ldd. The attack requires no special privileges beyond the ability to place a binary on the system and convince a user to run ldd on it (e.g., via social engineering) [1][3].

Impact

Successful exploitation results in arbitrary code execution with the privileges of the user running ldd. If the victim has root privileges, the attacker can gain full control of the system. The vulnerability also allows information disclosure and privilege escalation [4].

Mitigation

The glibc vendor considers this a non-issue, stating that other methods exist to introduce code if users download arbitrary binaries [description]. No official patch has been released. The recommended workaround is to avoid running ldd on untrusted binaries; alternative tools such as readelf -d or objdump -p should be used instead [3]. Some distribution-specific advisories (e.g., Red Hat) may provide additional guidance [2].