CVE-2015-5198

What it actually does

Local privilege escalation via unsanitized VDPAU_DRIVER_PATH environment variable in setuid or setgid processes that load libvdpau, allowing arbitrary shared library loading and execution with elevated privileges.

Why it matters to the business

Attackers with local access can obtain root-level control on affected systems, leading to data theft, persistence, or full host compromise; older distributions and embedded video workloads remain exposed years after disclosure.

How an attack unfolds

An attacker with a local shell identifies a setuid or setgid binary that links against vulnerable libvdpau, crafts a malicious shared object, exports VDPAU_DRIVER_PATH pointing to that object, then executes the binary; the library is loaded with the process privileges, granting code execution as root or the target user.

How to fix it

Upgrade libvdpau to version 1.1.1 or later on all systems; rebuild or replace any custom setuid/setgid applications that bundle older copies; remove unnecessary setuid/setgid bits from video-related binaries where feasible.

How to confirm the fix worked

Confirm installed libvdpau version is at least 1.1.1; run ldd against setuid binaries and verify they no longer resolve to pre-1.1.1 libraries; test by attempting to set VDPAU_DRIVER_PATH and executing the binary under a non-privileged account to ensure the variable is ignored.

Typical attack path

1. Locate setuid or setgid binaries that depend on libvdpau
2. Place a malicious shared library on a writable path
3. Export VDPAU_DRIVER_PATH to reference the malicious library
4. Execute the privileged binary to trigger library loading
5. Obtain elevated shell or execute arbitrary code

How to detect it

Review process creation logs and environment variable captures for occurrences of VDPAU_DRIVER_PATH; inspect setuid binary executions that load unexpected shared objects; correlate with subsequent privilege changes or new root-owned processes.

• VDPAU_DRIVER_PATH=
• libvdpau.so
• setuid.*vdpau
• /usr/lib/vdpau/

What your security team should do

• Patch or replace libvdpau immediately on any host still running versions before 1.1.1
• Audit and minimize use of setuid/setgid binaries that depend on video libraries
• Enable environment-variable sanitization policies for privileged processes
• Monitor package managers for any remaining dependent packages that pull in vulnerable libvdpau