IRONSMITHINTEL
HIGHCVSS7.8
|
Actively Exploited
|CISA KEV|CVE-2023-4911|Auth: low — authenticated user|Reboot: required|Manual only

GNU C Library Buffer Overflow Vulnerability

GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

Published Oct 3, 2023 · Updated May 16, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

A local attacker, with a low-privilege account, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2023-12-12 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Heap-based Buffer Overflow (CWE-122) vulnerability in GNU GNU C Library. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges. Exploitation requires local access, low attack complexity, a low-privilege authenticated account, and no user interaction required.

Am I affected?Quick check

Probably yes if any of these apply:

IT Security
Running bootstrap os: -; simatic s7-1500 tm mfp firmware: v < 1.1; glibc: 2.34 ≤ v < 2.39; fedora: 37, 38, 39; codeready linux builder: 9.0; codeready linux builder eus: 8.6, 9.2, 9.4, 9.6; codeready linux builder for arm64: 9.0_aarch64; codeready linux builder for arm64 eus: 8.6, 9.2_aarch64, 9.4_aarch64, 9.6_aarch64; codeready linux builder for ibm z systems: 9.0_s390x; codeready linux builder for ibm z systems eus: 8.6, 9.2_s390x, 9.4_s390x, 9.6_s390x; codeready linux builder for power little endian: 9.0_ppc64le; codeready linux builder for power little endian eus: 8.6, 9.2_ppc64le, 9.4_ppc64le, 9.6_ppc64le; virtualization: 4.0; virtualization host: 4.0; enterprise linux: 8.0, 9.0; enterprise linux eus: 8.6, 9.2, 9.4, 9.6; enterprise linux for arm 64: 9.0_aarch64; enterprise linux for arm 64 eus: 8.6_aarch64, 9.2_aarch64, 9.4_aarch64, 9.6_aarch64; enterprise linux for ibm z systems: 9.0_s390x; enterprise linux for ibm z systems eus: 9.2_s390x, 9.4_s390x, 9.6_s390x; enterprise linux for ibm z systems eus s390x: 8.6; enterprise linux for power big endian eus: 8.6_ppc64le; enterprise linux for power little endian: 9.0_ppc64le; enterprise linux for power little endian eus: 9.2_ppc64le, 9.4_ppc64le, 9.6_ppc64le; enterprise linux server aus: 8.6, 9.2, 9.4, 9.6; enterprise linux server for power little endian update services for sap solutions: 9.2_ppc64le, 9.4_ppc64le, 9.6_ppc64le; enterprise linux server tus: 8.6; enterprise linux update services for sap solutions: 9.2, 9.4, 9.6; ubuntu linux: 22.04, 23.04; debian linux: 11.0, 12.0; h410c firmware: -; h300s firmware: -; h500s firmware: -; h700s firmware: -; h410s firmware: -; ontap select deploy administration utility: -
Real-world incidentsWhat we've seen

Active exploitation documented in the wild. Threat-research write-up: https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

How to patch

Manual remediation steps

Apply the Vendor Patch

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog — apply the vendor's security update as soon as possible.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

    1
    Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2238352
    1
    NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-4911
    1
    CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.