NIXPKGS-2026-2724

GitHub issue published 9 hours ago

AT_SECURE program buffer overflow via $ORIGIN processing

Permalink CVE-2026-95818

3.6 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 9 hours ago by @LeSuisse Activity log

Created suggestion 19 hours ago
@LeSuisse ignored
17 packages
- libc
- iconv
- getent
- locale
- mtrace
- getconf
- libiconv
- glibcInfo
- glibc_multi
- glibcLocales
- glibc_memusage
- glibcLocalesUtf8
- unixtools.getent
- unixtools.locale
- unixtools.getconf
- minimal-bootstrap.glibc
- minimal-bootstrap.glibc-headers
9 hours ago
@LeSuisse accepted 9 hours ago
@LeSuisse published on GitHub 9 hours ago

AT_SECURE program buffer overflow via $ORIGIN processing

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

References

https://sourceware.org/bugzilla/show_bug.cgi?id=34360 issue-tracking
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026… vendor-advisory

Affected products

glibc

<2.45

Matching in nixpkgs

pkgs.glibc

GNU C Library

nixos-unstable -
- nixos-unstable-small 2.42-84
nixos-26.05 -
- nixos-26.05-small 2.42-84

Ignored packages (17)

pkgs.libc

GNU C Library

nixos-unstable -
- nixos-unstable-small 2.42-84
nixos-26.05 -
- nixos-26.05-small 2.42-84

pkgs.iconv

GNU C Library

nixos-unstable -
- nixos-unstable-small 2.42-84
nixos-26.05 -
- nixos-26.05-small 2.42-84

pkgs.getent

None

nixos-unstable -
- nixos-unstable-small 2.42-84
nixos-26.05 -
- nixos-26.05-small 2.42-84

pkgs.locale

None

nixos-unstable -
- nixos-unstable-small 2.42-84
nixos-26.05 -
- nixos-26.05-small 2.42-84

pkgs.mtrace

Perl script used to interpret and provide human readable output of the trace log contained in the file mtracedata, whose contents were produced by mtrace(3)