HackZoneLabs News
Newsletter

CVE-2023-4911

Glibc: buffer overflow in ld.so leading to privilege escalation

  • High 7.8
  • Exploited: added to CISA KEV 21 Nov 2023

Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Key facts

Published
3 Oct 2023
Last changed
7 Nov 2026
Assigned by
redhat
KEV added
21 Nov 2023
KEV fix due
12 Dec 2023
EPSS
63.769% likely to be exploited in the next 30 days, higher than 99.234% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: no; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 7.8CVSS 3.1, Highfrom the CNA (redhat)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What to do

  • For customers who cannot update immediately and do not have Secure Boot feature enabled, the issue can be mitigated using the provided SystemTap script with the following steps. When enabled, any setuid program invoked with GLIBC_TUNABLES in the environment will be terminated immediately. To invoke the setuid program, users will then have to unset or clear the GLIBC_TUNABLES envvar, e.g. `GLIBC_TUNABLES= sudo` . Note that these mitigation steps will need to be repeated if the system is rebooted. 1) Install required systemtap packages and dependencies as per - https://access.redhat.com/solutions/5441 2) Create the following systemtap script, and name it stap_block_suid_tunables.stp: ~~~ function has_tunable_string:long() { name = "GLIBC_TUNABLES" mm = @task(task_current())->mm; if (mm) { env_start = @mm(mm)->env_start; env_end = @mm(mm)->env_end; if (env_start != 0 && env_end != 0) while (env_end > env_start) { cur = user_string(env_start, ""); env_name = tokenize(cur, "="); if (env_name == name && tokenize("", "") != "") return 1; env_start += strlen (cur) + 1 } } return 0; } probe process("/lib*/ld*.so*").function("__tunables_init") { atsecure = 0; /* Skip processing if we can't read __libc_enable_secure, e.g. core dump handler (systemd-cgroups-agent and systemd-coredump). */ try { atsecure = @var("__libc_enable_secure"); } catch { printk (4, sprintf ("CVE-2023-4911: Skipped check: %s (%d)", execname(), pid())); } if (atsecure && has_tunable_string ()) raise (9); } ~CNA workaround statement
  • Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

CNA context is abbreviated; consult the original record for the complete statements.

Read the original CVE record.

Affected products

VendorProductVersions
Red HatRed Hat Enterprise Linux 8
  • Default status: affected
  • 0:2.28-225.el8_8.6 up to but excluding * (unaffected)
Red HatRed Hat Enterprise Linux 8
  • Default status: affected
  • 0:2.28-225.el8_8.6 up to but excluding * (unaffected)
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support
  • Default status: affected
  • 0:2.28-189.6.el8_6 up to but excluding * (unaffected)
Red HatRed Hat Enterprise Linux 9
  • Default status: affected
  • 0:2.34-60.el9_2.7 up to but excluding * (unaffected)
Red HatRed Hat Enterprise Linux 9
  • Default status: affected
  • 0:2.34-60.el9_2.7 up to but excluding * (unaffected)
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support
  • Default status: affected
  • 0:2.34-28.el9_0.4 up to but excluding * (unaffected)
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8
  • Default status: affected
  • 0:2.28-189.6.el8_6 up to but excluding * (unaffected)
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8
  • Default status: affected
  • 0:4.5.3-10.el8ev up to but excluding * (unaffected)
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8
  • Default status: affected
  • 0:4.5.3-202312060823_8.6 up to but excluding * (unaffected)
Red HatRed Hat Enterprise Linux 6
  • Default status: unaffected
Red HatRed Hat Enterprise Linux 7
  • Default status: unaffected
Red HatRed Hat Enterprise Linux 7
  • Default status: unaffected

Timeline

  1. 4 Sep 2023 Reported to Red Hat.
  2. 3 Oct 2023 Made public.
  3. 3 Oct 2023 Published
  4. 21 Nov 2023 CVE-2023-4911 added to CISA KEV
  5. 21 Nov 2023 Added to the CISA KEV catalogue

Weakness

References