The dynamic linker ld.so.1 contains a vulnerability when profiling dynamic libraries. The environment variable LD_PROFILE selects a library to be profiled. The results are written to a file in /var/tmp. When LD_PROFILE is set and a setuid executable is ran, a results file is created without dropping privileges. This allows creating world write-able files as root anywhere in the file system by using a symbolic link in /var/tmp.
Credit:
This vulnerability has been reported by: Job de Haas.
