static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH
CVE: CVE-2025-4802
Component: glibc
CWE: CWE-426
Severity: Moderate
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2025-05-16T00:00:00+00:00

A flaw was found in the glibc library. A statically linked setuid binary that calls dlopen(), including internal dlopen() calls after setlocale() or calls to NSS functions such as getaddrinfo(), may incorrectly search LD_LIBRARY_PATH to determine which library to load, allowing a local attacker to load malicious shared libraries, escalate privileges and execute arbitrary code.

Statement: This issue can only be exploitable by a local attacker via a static setuid program that calls the dlopen function, causing the library to search LD_LIBRARY_PATH to locate the shared object name to load. No such programs have been found in Red Hat Enterprise Linux at the time of publishing this advisory. However, custom setuid programs, although strongly discouraged as a security practice, may exist and can not be discarded. Due to these reasons, this flaw has been rated with a moderate severity.

Remediation:
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/

You may download the oc tool and use it to inspect release image metadata
for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests
may be found at
https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:8597a1a05b1792619cf56734de97fabe5f7ff77a100060924b4f5740ec10f2e1

      (For s390x architecture)
      The image digest is sha256:379c66f3c9f8aac11cdaa74614fd8d2b2c8a4626c3604f641d2ea7ee0d46be70

      (For ppc64le architecture)
      The image digest is sha256:5a5897081b628d1330e7d23dd3bd3de71cb647152fb1ed3a4fc10a85c4265ce1

      (For aarch64 architecture)
      The image digest is sha256:235fd4e1df9a004001768ee48ff44d102634c08b789cc37a329ad6a52f6ce13a

All OpenShift Container Platform 4.16 users are advised to upgrade to these
updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:20bf36ab093f1da58dc9662f6cd132803babe641b7471553d2cd6a929bdfc946

      (For s390x architecture)
      The image digest is sha256:dfef87cb5d0e6d86c4d1fdcbc10711625b621ea4b9b2ae1a9dbbb211197e1f46

      (For ppc64le architecture)
      The image digest is sha256:395d04f9b79b09b2fbd7377f25ef927b81da984095aaf39d285206b451a1b683

      (For aarch64 architecture)
      The image digest is sha256:c747886ef9befb315b20c99f29a39b10cbd07684a874aee15a5e777aaae50442

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:e6d80b9ab85b17b47e90cb8de1b9ad0e3fe457780148629d329d532ef902d222

      (For s390x architecture)
      The image digest is sha256:f9e0774cbbbd6e8cef31bb00b1bd13fc4e8ca94c552dacad15d7b90384b4bf9e

      (For ppc64le architecture)
      The image digest is sha256:a412f58cf7f7459c37a9352079ccb4c22b271c6b544bc992e8a2a92b3f020df8

      (For aarch64 architecture)
      The image digest is sha256:db9ffaf79548b7a3d5399ce98c0375c4bf9b8a4039cce46b6ebe8d1ac102d149

All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:1293f5ccad2a2776241344faecaf7320f60ee91882df4e24b309f3a7cefc04be

      (For s390x architecture)
      The image digest is sha256:36d81f05d22a9b8755b887793bacbd49d2ca0ce38197598bac692a4fb0e55ae7

      (For ppc64le architecture)
      The image digest is sha256:be3ec05343d4bf403b0e6cc1fb91cc05079314406d74cd52105342d7973919c4

      (For aarch64 architecture)
      The image digest is sha256:6bbbb8b93ae0b49d46e479ba6f37da92f8177309b2776a414a8f128ab67dbb41

All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.