[Bug dynamic-link/32976] elf: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=32976

--- Comment #8 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The release/2.38/master branch has been updated by Florian Weimer
<fw@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=31fa0f73e2fba5c3451d7e763eace3d669961c1c

commit 31fa0f73e2fba5c3451d7e763eace3d669961c1c
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue May 20 19:45:06 2025 +0200

    elf: Test case for bug 32976 (CVE-2025-4802)

    Check that LD_LIBRARY_PATH is ignored for AT_SECURE statically
    linked binaries, using support_capture_subprogram_self_sgid.

    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    (cherry picked from commit d8f7a79335b0d861c12c42aec94c04cd5bb181e2)

-- 
You are receiving this mail because:
You are on the CC list for the bug.