CVE-2023-4911KEV Β· OVERDUECWE-122CWE-787

GNU C Library Buffer Overflow Vulnerability

High Β· published October 3, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 99.2th percentile for exploit probability.

1047
days past CISA
deadline
CVSS v3.1
7.8
EPSS
64%
Percentile
99.2
In the wild
Confirmed
What it is

🚨 A buffer overflow in the GNU C Library could let crafty locals escalate their privileges with just a malicious environment variable! πŸ”₯ Think of it like a delivery driver who can sneak in a hidden package while dropping off a regular one at your front doorstep. If they slip in the right 'GLIBC_TUNABLES', they can gain access to areas of your system they shouldn't β€” like a VIP pass to the backroom! If exploited, a local attacker could execute arbitrary code with elevated privileges, potentially compromising the entire system. This means they can do anything from stealing sensitive data to altering critical configurations. It's a sneaky backdoor that could lead to devastating consequences for your infrastructure!

Put simply

Think of it like a delivery driver who can sneak in a hidden package while dropping off a regular one at your front doorstep. If they slip in the right 'GLIBC_TUNABLES', they can gain access to areas of your system they shouldn't β€” like a VIP pass to the backroom! This vulnerability occurs when the GNU C Library’s dynamic loader mishandles the GLIBC_TUNABLES environment variable, allowing attackers to execute code with SUID permissions by crafting carefully designed inputs.

What to do

If exploited, a local attacker could execute arbitrary code with elevated privileges, potentially compromising the entire system. This means they can do anything from stealing sensitive data to altering critical configurations. It's a sneaky backdoor that could lead to devastating consequences for your infrastructure! Immediately upgrade to the fixed version of the GNU C Library to patch this vulnerability. Review and limit the use of SUID permissions where possible, and monitor your environment variables for anything suspicious. Regular audits can help keep these vulnerabilities at bay! You’ve got this! Follow these steps, and you’ll keep your systems safe and sound. πŸ›‘οΈ

The record
Technical detail
CVSS v3.1
7.8 Β· HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.63769 Β· 99.2th percentile
Weaknesses
CWE-122 Β· Heap-based Buffer Overflow; CWE-787 Β· Out-of-bounds Write
Published
2023-10-03T22:15Z
KEV added
2023-11-21 Β· due 2023-12-12
Affected products (73)
ProductVersionsFixed in
netapp/bootstrap_osall versionsβ€”
siemens/simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmwareβ‰₯ 3.1.5β€”
siemens/simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmwareβ‰₯ 3.1.5β€”
siemens/siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmwareβ‰₯ 3.1.5β€”
siemens/simatic_s7-1500_tm_mfp_firmware< 1.11.1
gnu/glibcβ‰₯ 2.34, < 2.392.39
fedoraproject/fedoraall versionsβ€”
fedoraproject/fedoraall versionsβ€”
fedoraproject/fedoraall versionsβ€”
redhat/codeready_linux_builderall versionsβ€”
redhat/codeready_linux_builder_eusall versionsβ€”
redhat/codeready_linux_builder_eusall versionsβ€”
redhat/codeready_linux_builder_eusall versionsβ€”
redhat/codeready_linux_builder_eusall versionsβ€”
redhat/codeready_linux_builder_for_arm64all versionsβ€”
redhat/codeready_linux_builder_for_arm64_eusall versionsβ€”
redhat/codeready_linux_builder_for_arm64_eusall versionsβ€”
redhat/codeready_linux_builder_for_arm64_eusall versionsβ€”
redhat/codeready_linux_builder_for_arm64_eusall versionsβ€”
redhat/codeready_linux_builder_for_ibm_z_systemsall versionsβ€”
redhat/codeready_linux_builder_for_ibm_z_systems_eusall versionsβ€”
redhat/codeready_linux_builder_for_ibm_z_systems_eusall versionsβ€”
redhat/codeready_linux_builder_for_ibm_z_systems_eusall versionsβ€”
redhat/codeready_linux_builder_for_ibm_z_systems_eusall versionsβ€”
redhat/codeready_linux_builder_for_power_little_endianall versionsβ€”
redhat/codeready_linux_builder_for_power_little_endian_eusall versionsβ€”
redhat/codeready_linux_builder_for_power_little_endian_eusall versionsβ€”
redhat/codeready_linux_builder_for_power_little_endian_eusall versionsβ€”
redhat/codeready_linux_builder_for_power_little_endian_eusall versionsβ€”
redhat/virtualizationall versionsβ€”
redhat/virtualization_hostall versionsβ€”
redhat/enterprise_linuxall versionsβ€”
redhat/enterprise_linuxall versionsβ€”
redhat/enterprise_linux_eusall versionsβ€”
redhat/enterprise_linux_eusall versionsβ€”
redhat/enterprise_linux_eusall versionsβ€”
redhat/enterprise_linux_eusall versionsβ€”
redhat/enterprise_linux_for_arm_64all versionsβ€”
redhat/enterprise_linux_for_arm_64_eusall versionsβ€”
redhat/enterprise_linux_for_arm_64_eusall versionsβ€”
redhat/enterprise_linux_for_arm_64_eusall versionsβ€”
redhat/enterprise_linux_for_arm_64_eusall versionsβ€”
redhat/enterprise_linux_for_ibm_z_systemsall versionsβ€”
redhat/enterprise_linux_for_ibm_z_systems_eusall versionsβ€”
redhat/enterprise_linux_for_ibm_z_systems_eusall versionsβ€”
redhat/enterprise_linux_for_ibm_z_systems_eusall versionsβ€”
redhat/enterprise_linux_for_ibm_z_systems_eus_s390xall versionsβ€”
redhat/enterprise_linux_for_power_big_endian_eusall versionsβ€”
redhat/enterprise_linux_for_power_little_endianall versionsβ€”
redhat/enterprise_linux_for_power_little_endian_eusall versionsβ€”
redhat/enterprise_linux_for_power_little_endian_eusall versionsβ€”
redhat/enterprise_linux_for_power_little_endian_eusall versionsβ€”
redhat/enterprise_linux_server_ausall versionsβ€”
redhat/enterprise_linux_server_ausall versionsβ€”
redhat/enterprise_linux_server_ausall versionsβ€”
redhat/enterprise_linux_server_ausall versionsβ€”
redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsall versionsβ€”
redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsall versionsβ€”
redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsall versionsβ€”
redhat/enterprise_linux_server_tusall versionsβ€”
redhat/enterprise_linux_update_services_for_sap_solutionsall versionsβ€”
redhat/enterprise_linux_update_services_for_sap_solutionsall versionsβ€”
redhat/enterprise_linux_update_services_for_sap_solutionsall versionsβ€”
canonical/ubuntu_linuxall versionsβ€”
canonical/ubuntu_linuxall versionsβ€”
debian/debian_linuxall versionsβ€”
debian/debian_linuxall versionsβ€”
netapp/h410c_firmwareall versionsβ€”
netapp/h300s_firmwareall versionsβ€”
netapp/h500s_firmwareall versionsβ€”
netapp/h700s_firmwareall versionsβ€”
netapp/h410s_firmwareall versionsβ€”
netapp/ontap_select_deploy_administration_utilityall versionsβ€”
References (39)
https://access.redhat.com/errata/RHSA-2023:5453 Β· [email protected]https://access.redhat.com/errata/RHSA-2023:5454 Β· [email protected]https://access.redhat.com/errata/RHSA-2023:5455 Β· [email protected]https://access.redhat.com/errata/RHSA-2023:5476 Β· [email protected]https://access.redhat.com/errata/RHSA-2024:0033 Β· [email protected]https://access.redhat.com/security/cve/CVE-2023-4911 Β· [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2238352 Β· [email protected]https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt Β· [email protected]https://www.qualys.com/cve-2023-4911/ Β· [email protected]http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html Β· af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html Β· af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2023/Oct/11 Β· af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/03/2 Β· af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/03/3 Β· af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/05/1 Β· af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/13/11 Β· af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/14/3 Β· af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/14/5 Β· af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/14/6 Β· af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2023:5453 Β· af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2023:5454 Β· af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2023:5455 Β· af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2023:5476 Β· af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:0033 Β· af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2023-4911 Β· af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2238352 Β· af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/ Β· af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/ Β· af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/ Β· af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202310-03 Β· af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20231013-0006/ Β· af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5514 Β· af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/52479 Β· af854a3a-2127-422b-91ae-364da2661108https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt Β· af854a3a-2127-422b-91ae-364da2661108https://www.qualys.com/cve-2023-4911/ Β· af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-082556.html Β· 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-794697.html Β· 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-831302.html Β· 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911 Β· 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 OCT 03:33Z
    EPSS moved 81% β†’ 64%
    epss
  • 21 NOV 00:00Z
    Added to CISA KEV β€” remediate by Dec 12
    kev
  • 03 OCT 17:25Z
    Glibc: buffer overflow in ld.so leading to privilege escalation
    cvelistv5