Buffer Overflow shell question

Question

If a custom library is affected by a buffer overflow and it is linked against an executable running as root. If an attacker gains a remote reverse shell, it will run under the user of the linked executable?

Answer 1

A library that links against an executable will share all attributes of the process, including UID. For example, a vulnerable OpenSSL library linking against an executable whose process is running as www-data will, if exploited, give access to that user. If the same exact library is linked against an executable whose process is running as root, then exploitation will give access to that user.