Skip to content

Back to the catalog

bencteux.fradvisory

CVE-2023-47480: unchecked return values of set*id() family functions in Puredata

Researcher writeup on CVE-2023-47480, where the Pure Data (Pd) visual programming language failed to check return values of set*id() family functions (e.g. setuid()), which could allow the process to silently continue running with elevated privileges if the privilege-drop call failed. Maintainers (fixed by Umläute) patched it in Nov 2023 to abort execution on setuid() failure; the author notes this is the same bug class as their earlier CVE-2023-40303 in GNU inetutils. Impact is rated moderate since triggering setuid() failure is hard and Pd is not widely deployed.

TL;DR CVE-2023-47480: Pure Data ignored setuid()/setgid() return values, a privilege-escalation-adjacent bug pattern the researcher previously found in GNU inetutils (CVE-2023-40303).
Open original ↗

CVEs named here

Technologies named here

  • Pure Data

Techniques named here

Related in AppSec