CVE-2023-4911highunder attackCWE-122

CVE-2023-4911: high-severity vulnerability in glibc

Glibc: buffer overflow in ld.so leading to privilege escalation

Published · Updated

Follow this CVE+ Monitor Red Hat Enterprise Linux+ Monitor Red Hat Enterprise Linux 8.6 Extended Update Support

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.8epss 64%
from disclosure to weapon1 day
Published on NVDOct 3
1st PoC+1d
metasploitOct 3
CISA KEV+49d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
14 products (4,066 components)
Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v.8.6) · Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat Enterprise Linux BaseOS EUS (v.9.0) · Red Hat CodeReady Linux Builder EUS (v.9.0) · and others 9
fix ↗
Not affected
2 products (18 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
Action required by CISAfederal deadline: 2023-12-12

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Linux's core library allows attackers to overflow a buffer by setting a special environment variable, potentially letting them run malicious code with administrator rights on vulnerable systems.

Technical detail

A buffer overflow exists in glibc's ld.so dynamic loader during GLIBC_TUNABLES environment variable parsing. Local attackers can exploit this via crafted environment variables on SUID binaries to achieve arbitrary code execution with elevated privileges; exploitation requires local access and presence of a vulnerable SUID binary.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
glibcRed Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 8.6 Extended Update SupportRed Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 9.0 Extended Update SupportRed Hat · Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
public PoCs found — 50
cve_referencewww.exploit-db.com/exploits/52479unverifiedgithubgithub.com/leesh3288/CVE-2023-4911★ 393githubgithub.com/RickdeJager/CVE-2023-4911★ 167githubgithub.com/chaudharyarjun/LooneyPwner★ 43githubgithub.com/hadrian3689/looney-tunables-CVE-2023-4911★ 29githubgithub.com/ruycr4ft/CVE-2023-4911★ 19githubgithub.com/KernelKrise/CVE-2023-4911★ 18githubgithub.com/Green-Avocado/CVE-2023-4911★ 15githubgithub.com/Diego-AltF4/CVE-2023-4911★ 8githubgithub.com/NishanthAnand21/CVE-2023-4911-PoC★ 8githubgithub.com/jarpex/cve-2023-4911-exploit-optimized★ 4githubgithub.com/puckiestyle/CVE-2023-4911★ 2githubgithub.com/teraGL/looneyCVE★ 1githubgithub.com/xiaoQ1z/CVE-2023-4911★ 1githubgithub.com/KillReal01/CVE-2023-4911★ 0githubgithub.com/guffre/CVE-2023-4911★ 0githubgithub.com/0xMOGA/CVE-2023-4911-Lab★ 0githubgithub.com/silent6trinity/looney-tuneables★ 0githubgithub.com/snurkeburk/Looney-Tunables★ 0githubgithub.com/baeseungwon1010/CVE-2023-4911★ 0githubgithub.com/adewlee87-rgb/cve-2023-4911-looney-tunables★ 0githubgithub.com/Billar42/CVE-2023-4911★ 0githubgithub.com/Aryan20057/CVE-2023-4911★ 0vulncheckvulncheck.com/xdb/c66f71d05ca3unverifiedvulncheckvulncheck.com/xdb/dd2d2990ad7aunverifiedvulncheckvulncheck.com/xdb/c3f0dfef6dc3unverifiedvulncheckvulncheck.com/xdb/912fdfa3ffcbunverifiedvulncheckvulncheck.com/xdb/787652a02f89unverifiedcve_referencepacketstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.htmlunverifiedcve_referencepacketstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.htmlunverifiedvulncheckvulncheck.com/xdb/847bf09204caunverifiedvulncheckvulncheck.com/xdb/c1e2b0d1e872unverifiedvulncheckvulncheck.com/xdb/6ddd35f752a2unverifiedvulncheckvulncheck.com/xdb/24a3ae6b3ae0unverifiedvulncheckvulncheck.com/xdb/e9cc8a9653c6unverifiedvulncheckvulncheck.com/xdb/e8ba401a5397unverifiedvulncheckvulncheck.com/xdb/0bfd16ee5c6eunverifiedvulncheckvulncheck.com/xdb/1bf2c7948d0aunverifiedvulncheckvulncheck.com/xdb/7154c8a75572unverifiedvulncheckvulncheck.com/xdb/d7f283c48b1aunverifiedvulncheckvulncheck.com/xdb/847b8ad5421funverifiedvulncheckvulncheck.com/xdb/4a0f3cecfcf5unverifiedvulncheckvulncheck.com/xdb/d9dc0002293funverifiedvulncheckvulncheck.com/xdb/270ec9b3f4c1unverifiedvulncheckvulncheck.com/xdb/794f2256b177unverifiedvulncheckvulncheck.com/xdb/7386501edb9eunverifiedvulncheckvulncheck.com/xdb/60ac54a2a53aunverifiedvulncheckvulncheck.com/xdb/b43d5e2b6b33unverifiedvulncheckvulncheck.com/xdb/208283cc4e70unverifiedvulncheckvulncheck.com/xdb/6dd56d3450b7unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — glibc

In the same product, most dangerous first.

CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-3094CRITICALXz: malicious code in distributed sourceEPSS 90.9%CVE-2023-46847HIGHSquid: denial of service in http digest authenticationEPSS 78.5%CVE-2024-12084CRITICALRsync: heap buffer overflow in rsync due to improper checksum length handlingEPSS 72.5%CVE-2023-1183MEDIUMArbitrary file writeEPSS 64.9%CVE-2023-34966HIGHSamba: infinite loop in mdssvc rpc service for spotlightEPSS 62.4%