Arbitrary Code Execution in GNU libextractor via Environment Variable Injection

GNU libextractor before version 1.16 contains a vulnerability where the library fails to properly validate the LIBEXTRACTOR_PREFIX environment variable when searching for plugins. Because this variable influences the library's plugin loading path, a local attacker can set it to a directory they control. If a setuid or setgid binary utilizes libextractor, the library will load and execute malicious plugins located in the attacker-supplied directory with the privileges of the binary. This vulnerability allows an attacker to achieve privilege escalation on the host system. This is particularly critical in environments where setuid/setgid binaries are commonly used or where libextractor is embedded in privileged services.

Impact

Successful exploitation of this vulnerability enables a local attacker to execute arbitrary code with elevated privileges. This could lead to a full system compromise, data theft, or persistence on the affected host. The scope is limited to systems where libextractor is utilized by setuid or setgid programs.

Recommendation

• Upgrade libextractor to version 1.16 or later immediately to address the insecure environment variable handling.
• Audit existing setuid and setgid binaries on Linux systems to determine if they are linked against the affected libextractor library.
• Implement environment variable sanitization policies for high-privilege service accounts to prevent the injection of arbitrary paths into library search variables.