Fluid Attacks Database

Description

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	glibc	>=0 <2.29-8	2.29-8
debian 11	glibc	>=0 <2.29-8	2.29-8
debian 13	glibc	>=0 <2.29-8	2.29-8
debian 12	glibc	>=0 <2.29-8	2.29-8
rpm rhel8	glibc	<0:2.28-101.el8	0:2.28-101.el8
rpm rhel5	glibc	-	-
rpm rhel6	glibc	-	-
rpm rhel7	glibc	<0:2.17-317.el7	0:2.17-317.el7

Aliases

1. CVE-2019-191262. NVD-2019-191263. OSV-DEBIAN-2019-191264. OSV-2019-191265. SECURITY-TRACKER-CVE-2019-19126

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.