Description
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Canonical / Ubuntu Linux22.04 – 22.04
- Canonical / Ubuntu Linux23.04 – 23.04
- Debian / debian_linux11.0 – 11.0
- Debian / debian_linux12.0 – 12.0
- fedoraproject / fedora38 – 38
- fedoraproject / fedora39 – 39
- fedoraproject / fedora37 – 37
- gnu / glibc2.34 – 2.39
- NetApp / bootstrap_os
- NetApp / h300s_firmware
- NetApp / h410c_firmware
- NetApp / h410s_firmware
- NetApp / h500s_firmware
- NetApp / h700s_firmware
- NetApp / ONTAP Select Deploy administration utility
- RedHat / codeready_linux_builder9.0 – 9.0
- RedHat / codeready_linux_builder_eus9.6 – 9.6
- RedHat / codeready_linux_builder_eus8.6 – 8.6
- RedHat / codeready_linux_builder_eus9.2 – 9.2
- RedHat / codeready_linux_builder_eus9.4 – 9.4
- RedHat / codeready_linux_builder_for_arm649.0_aarch64 – 9.0_aarch64
- RedHat / codeready_linux_builder_for_arm64_eus9.4_aarch64 – 9.4_aarch64
- RedHat / codeready_linux_builder_for_arm64_eus9.6_aarch64 – 9.6_aarch64
- RedHat / codeready_linux_builder_for_arm64_eus9.2_aarch64 – 9.2_aarch64
- RedHat / codeready_linux_builder_for_arm64_eus8.6 – 8.6
- RedHat / codeready_linux_builder_for_ibm_z_systems9.0_s390x – 9.0_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems_eus8.6 – 8.6
- RedHat / codeready_linux_builder_for_ibm_z_systems_eus9.2_s390x – 9.2_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems_eus9.4_s390x – 9.4_s390x
- RedHat / codeready_linux_builder_for_ibm_z_systems_eus9.6_s390x – 9.6_s390x
- RedHat / codeready_linux_builder_for_power_little_endian9.0_ppc64le – 9.0_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian_eus9.6_ppc64le – 9.6_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian_eus9.4_ppc64le – 9.4_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian_eus9.2_ppc64le – 9.2_ppc64le
- RedHat / codeready_linux_builder_for_power_little_endian_eus8.6 – 8.6
- RedHat / enterprise_linux9.0 – 9.0
- RedHat / enterprise_linux8.0 – 8.0
- RedHat / enterprise_linux_eus9.4 – 9.4
- RedHat / enterprise_linux_eus9.6 – 9.6
- RedHat / enterprise_linux_eus8.6 – 8.6
- RedHat / enterprise_linux_eus9.2 – 9.2
- RedHat / enterprise_linux_for_arm_649.0_aarch64 – 9.0_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.6_aarch64 – 9.6_aarch64
- RedHat / enterprise_linux_for_arm_64_eus8.6_aarch64 – 8.6_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.2_aarch64 – 9.2_aarch64
- RedHat / enterprise_linux_for_arm_64_eus9.4_aarch64 – 9.4_aarch64
- RedHat / enterprise_linux_for_ibm_z_systems9.0_s390x – 9.0_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.4_s390x – 9.4_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.2_s390x – 9.2_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus9.6_s390x – 9.6_s390x
- RedHat / enterprise_linux_for_ibm_z_systems_eus_s390x8.6 – 8.6
- RedHat / enterprise_linux_for_power_big_endian_eus8.6_ppc64le – 8.6_ppc64le
- RedHat / enterprise_linux_for_power_little_endian9.0_ppc64le – 9.0_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.2_ppc64le – 9.2_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.6_ppc64le – 9.6_ppc64le
- RedHat / enterprise_linux_for_power_little_endian_eus9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_server_aus9.6 – 9.6
- RedHat / enterprise_linux_server_aus8.6 – 8.6
- RedHat / enterprise_linux_server_aus9.2 – 9.2
- RedHat / enterprise_linux_server_aus9.4 – 9.4
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions9.2_ppc64le – 9.2_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions9.4_ppc64le – 9.4_ppc64le
- RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions9.6_ppc64le – 9.6_ppc64le
- RedHat / enterprise_linux_server_tus8.6 – 8.6
- RedHat / enterprise_linux_update_services_for_sap_solutions9.4 – 9.4
- RedHat / enterprise_linux_update_services_for_sap_solutions9.2 – 9.2
- RedHat / enterprise_linux_update_services_for_sap_solutions9.6 – 9.6
- RedHat / virtualization4.0 – 4.0
- RedHat / virtualization_host4.0 – 4.0
- Siemens / simatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware3.1.5 –
- Siemens / simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware3.1.5 –
- Siemens / simatic_s7-1500_tm_mfp_firmware1.1
- Siemens / siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware3.1.5 –
Exploits & proofs of concept
- exploit-dbglibc 2.38 - Buffer Overflowby Beatriz Fresno Naumova
- nucleiLooney Tunables Linux - Local Privilege Escalationby nybble04
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:5453
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:5454
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:5455
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2023:5476
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:0033
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2023-4911
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2238352
- MISChttps://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
- MISChttps://www.qualys.com/cve-2023-4911/
Updated 22m ago · 8 sources