Linux recently discovered a vulnerability known as “Looney Tunables” that allows local attackers to gain superpower rights by exploiting a buffer overflow in the dynamic LD.SO Library Gnu C.
The GNU C (Glibc) Library is a standard library for the GNU system and is present in most Linux kernel systems. It provides necessary functionality, including system calls like Open, Malloc, Printf, and Exit.
The dynamic bootloader in Glibc is particularly important as it is responsible for preparing and executing programs in Linux systems that use Glibc.
The vulnerability, discovered by the Qualys Threat Research Unit team, was added more than two years ago in April 2021. It was implemented with the release of the GLIBC downloader version 2.34 and affects the SXID_ERase behavior in Setuid.
Said Abbasi, a product manager at Qualys, highlighted the seriousness of the vulnerability, stating: “Our successful exploitation, which granted complete superpower rights on common distributions like Fedora, Ubuntu, and Debian, underscores the seriousness of this vulnerability.”
The vulnerability is triggered when processing the Glibc_tunables environment in standard installations of Debian 12 and 13, Ubuntu 04.22 and 23.04, as well as Fedora 37 and 38.
The Advisory Center at Red Hat explained that a buffer overflow was discovered in the dynamic loader LD.SO GNU C Library when processing the Glibc_tunables environment variable. Low-privileged attacks can exploit this critical vulnerability with low complexity and without user involvement.
Abbasi further added, “Considering the potential for obtaining full access to the ROOT user, it grants all rights and full access to functions and files. This includes the ability to install and uninstall software, modify system settings, create, modify, and delete files anywhere in the system, and more.”
Root access can be useful for experienced users and developers as it provides greater flexibility and control over the device. However, the use of Root access carries risks, as incorrect changes or the installation of malicious software can damage the device or compromise its security.