CVEvulnerability
CVE-2023-4911
CISA Known Exploited Vulnerability
GNU C Library Buffer Overflow Vulnerability — GNU GNU C Library
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
- Added to KEV
- 2023-11-21
- Remediation due
- 2023-12-12
- Ransomware use
- Unknown
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Notes
- This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa, https://access.redhat.com/security/cve/cve-2023-4911, https://www.debian.org/security/2023/dsa-5514 ; https://nvd.nist.gov/vuln/detail/CVE-2023-4911
- Status
- Analyzed
- Published
- 2023-10-03
- Last modified
- 2026-10-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-122, CWE-787
Description
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Affected configurations
• netapp bootstrap os
• siemens simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware (>= 3.1.5)
• siemens simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware (>= 3.1.5)
• siemens siplus s7-1500 cpu 1518-4 pn\/dp mfp firmware (>= 3.1.5)
• siemens simatic s7-1500 tm mfp firmware (< 1.1)
• gnu glibc (>= 2.34 < 2.39)
• fedoraproject fedora 37
• fedoraproject fedora 38
• fedoraproject fedora 39
• redhat codeready linux builder 9.0
• redhat codeready linux builder eus 8.6
• redhat codeready linux builder eus 9.2
• redhat codeready linux builder eus 9.4
• redhat codeready linux builder eus 9.6
• redhat codeready linux builder for arm64 9.0 aarch64
• redhat codeready linux builder for arm64 eus 8.6
• redhat codeready linux builder for arm64 eus 9.2 aarch64
• redhat codeready linux builder for arm64 eus 9.4 aarch64
• redhat codeready linux builder for arm64 eus 9.6 aarch64
• redhat codeready linux builder for ibm z systems 9.0 s390x
• redhat codeready linux builder for ibm z systems eus 8.6
• redhat codeready linux builder for ibm z systems eus 9.2 s390x
• redhat codeready linux builder for ibm z systems eus 9.4 s390x
• redhat codeready linux builder for ibm z systems eus 9.6 s390x
• redhat codeready linux builder for power little endian 9.0 ppc64le
• redhat codeready linux builder for power little endian eus 8.6
• redhat codeready linux builder for power little endian eus 9.2 ppc64le
• redhat codeready linux builder for power little endian eus 9.4 ppc64le
• redhat codeready linux builder for power little endian eus 9.6 ppc64le
• redhat virtualization 4.0
• redhat virtualization host 4.0
• redhat enterprise linux 8.0
• redhat enterprise linux 9.0
• redhat enterprise linux eus 8.6
• redhat enterprise linux eus 9.2
• redhat enterprise linux eus 9.4
• redhat enterprise linux eus 9.6
• redhat enterprise linux for arm 64 9.0 aarch64
• redhat enterprise linux for arm 64 eus 8.6 aarch64
• redhat enterprise linux for arm 64 eus 9.2 aarch64
• redhat enterprise linux for arm 64 eus 9.4 aarch64
• redhat enterprise linux for arm 64 eus 9.6 aarch64
• redhat enterprise linux for ibm z systems 9.0 s390x
• redhat enterprise linux for ibm z systems eus 9.2 s390x
• redhat enterprise linux for ibm z systems eus 9.4 s390x
• redhat enterprise linux for ibm z systems eus 9.6 s390x
• redhat enterprise linux for ibm z systems eus s390x 8.6
• redhat enterprise linux for power big endian eus 8.6 ppc64le
• redhat enterprise linux for power little endian 9.0 ppc64le
• redhat enterprise linux for power little endian eus 9.2 ppc64le
• redhat enterprise linux for power little endian eus 9.4 ppc64le
• redhat enterprise linux for power little endian eus 9.6 ppc64le
• redhat enterprise linux server aus 8.6
• redhat enterprise linux server aus 9.2
• redhat enterprise linux server aus 9.4
• redhat enterprise linux server aus 9.6
• redhat enterprise linux server for power little endian update services for sap solutions 9.2 ppc64le
• redhat enterprise linux server for power little endian update services for sap solutions 9.4 ppc64le
• redhat enterprise linux server for power little endian update services for sap solutions 9.6 ppc64le
• redhat enterprise linux server tus 8.6
… and 13 more
Related
References
- https://access.redhat.com/errata/RHSA-2023:5453 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5454 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5455 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5476 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:0033 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-4911 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352 Issue Tracking, Patch
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt Exploit, Third Party Advisory
- https://www.qualys.com/cve-2023-4911/ Third Party Advisory
- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2023/Oct/11 Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/10/03/2 Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/03/3 Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/05/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/13/11 Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/3 Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/5 Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/6 Mailing List
- https://access.redhat.com/errata/RHSA-2023:5453 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5454 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5455 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5476 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:0033 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-4911 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352 Issue Tracking, Patch
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/ Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/ Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/ Mailing List
- https://security.gentoo.org/glsa/202310-03 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231013-0006/ Third Party Advisory
- https://www.debian.org/security/2023/dsa-5514 Mailing List
- https://www.exploit-db.com/exploits/52479 Exploit, Third Party Advisory, VDB Entry
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt Exploit, Third Party Advisory
- https://www.qualys.com/cve-2023-4911/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911 US Government Resource