Local privilege escalation in OpenBSD affecting setuid programs

CVE-2019-19726

Summary

OpenBSD versions up to 6.6 are susceptible to a local privilege escalation vulnerability due to improper handling of the LD_LIBRARY_PATH environment variable in setuid programs. Attackers can exploit this flaw by setting a minimal RLIMIT_DATA resource limit, which allows them to bypass security checks implemented in the dynamic loader (ld.so). This vulnerability can be exploited during the execution of commands like chpass or passwd, permitting the attacker to run their own code with root privileges.

References