AI analysis
GNU libextractor before 1.16 loads plugins from a directory given by the LIBEXTRACTOR_PREFIX environment variable without checking whether the process is running with elevated privileges. A local attacker who can set that variable can point it at a directory containing a malicious plugin. When a setuid or setgid program then loads libextractor, the plugin runs as arbitrary code with the program's elevated privileges. The issue affects systems that ship vulnerable libextractor and use it from privileged binaries; ordinary unprivileged use does not by itself yield escalation. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade GNU libextractor to 1.16 or later on every host that ships it. Until then, do not run setuid or setgid programs that load libextractor, and prevent untrusted users from setting LIBEXTRACTOR_PREFIX for those processes. Inventory setuid/setgid binaries and confirm whether they link libextractor.
Affected
| GNU libextractor | before 1.16 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTOR_PREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTOR_PREFIX to a directory containing a malicious plugin that executes arbitrary code with elevated privileges when loaded by a setuid or setgid program.