Local Privilege Escalation in OpenBSD's dynamic loader (CVE-2019-19726)
https://marc.info/?l=oss-security&m=157609898721656&w=2 [marc.info]
2019-12-11 23:22
1a/ we set the LD_LIBRARY_PATH environment variable to one single dot (the current working directory) and approximately ARG_MAX colons (the maximum number of bytes for the argument and environment list); as described in man ld.so:
1b/ we set the RLIMIT_DATA resource limit to ARG_MAX * sizeof(char *) (2MB on amd64, 1MB on i386); as described in man setrlimit: