Back to the CVE list
CVE-2023-4911 CISA KEV · Actively exploited

Glibc: buffer overflow in ld.so leading to privilege escalation

CVSS score

7.8

EPSS probability

%63.8

Risk score

9.9

Published

3 y ago

OverviewPublic Exploits (6)NewsroomVulnerability Timeline
Official patch verified

Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2023-4911 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2023-4911 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1redhatglibc View
2Red HatRed Hat Enterprise Linux 8 View
3Red HatRed Hat Enterprise Linux 8.6 Extended Update Support View
4Red HatRed Hat Enterprise Linux 9 View
5Red HatRed Hat Enterprise Linux 9.0 Extended Update Support View
6Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8 View
7Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8 View
8Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8 View
9Red HatRed Hat Enterprise Linux 6 View
10Red HatRed Hat Enterprise Linux 7 View
11netappbootstrap os View
12netapphci compute node View
13siemenssimatic s7-1500 cpu 1518-4 pn/dp mfp firmware View
14siemenssimatic s7-1500 cpu 1518-4 pn/dp mfp View
15siemenssimatic s7-1500 cpu 1518f-4 pn/dp mfp firmware View
16siemenssimatic s7-1500 cpu 1518f-4 pn/dp mfp View
17siemenssiplus s7-1500 cpu 1518-4 pn/dp mfp firmware View
18siemenssiplus s7-1500 cpu 1518-4 pn/dp mfp View
19siemenssimatic s7-1500 tm mfp firmware View
20siemenssimatic s7-1500 tm mfp View
21gnuglibc View
22fedoraprojectfedora View
23fedoraprojectfedora View
24fedoraprojectfedora View
25redhatcodeready linux builder View
26redhatcodeready linux builder eus View
27redhatcodeready linux builder eus View
28redhatcodeready linux builder eus View
29redhatcodeready linux builder eus View
30redhatcodeready linux builder for arm64 View
31redhatcodeready linux builder for arm64 eus View
32redhatcodeready linux builder for arm64 eus View
33redhatcodeready linux builder for arm64 eus View
34redhatcodeready linux builder for arm64 eus View
35redhatcodeready linux builder for ibm z systems View
36redhatcodeready linux builder for ibm z systems eus View
37redhatcodeready linux builder for ibm z systems eus View
38redhatcodeready linux builder for ibm z systems eus View
39redhatcodeready linux builder for ibm z systems eus View
40redhatcodeready linux builder for power little endian View
41redhatcodeready linux builder for power little endian eus View
42redhatcodeready linux builder for power little endian eus View
43redhatcodeready linux builder for power little endian eus View
44redhatcodeready linux builder for power little endian eus View
45redhatvirtualization View
46redhatvirtualization host View
47redhatenterprise linux View
48redhatenterprise linux View
49redhatenterprise linux eus View
50redhatenterprise linux eus View
51redhatenterprise linux eus View
52redhatenterprise linux eus View
53redhatenterprise linux for arm 64 View
54redhatenterprise linux for arm 64 eus View
55redhatenterprise linux for arm 64 eus View
56redhatenterprise linux for arm 64 eus View
57redhatenterprise linux for arm 64 eus View
58redhatenterprise linux for ibm z systems View
59redhatenterprise linux for ibm z systems eus View
60redhatenterprise linux for ibm z systems eus View
61redhatenterprise linux for ibm z systems eus View
62redhatenterprise linux for ibm z systems eus s390x View
63redhatenterprise linux for power big endian eus View
64redhatenterprise linux for power little endian View
65redhatenterprise linux for power little endian eus View
66redhatenterprise linux for power little endian eus View
67redhatenterprise linux for power little endian eus View
68redhatenterprise linux server aus View
69redhatenterprise linux server aus View
70redhatenterprise linux server aus View
71redhatenterprise linux server aus View
72redhatenterprise linux server for power little endian update services for sap solutions View
73redhatenterprise linux server for power little endian update services for sap solutions View
74redhatenterprise linux server for power little endian update services for sap solutions View
75redhatenterprise linux server tus View
76redhatenterprise linux update services for sap solutions View
77redhatenterprise linux update services for sap solutions View
78redhatenterprise linux update services for sap solutions View
79canonicalubuntu linux View
80canonicalubuntu linux View
81debiandebian linux View
82debiandebian linux View
83netapph410c firmware View
84netapph410c View
85netapph300s firmware View
86netapph300s View
87netapph500s firmware View
88netapph500s View
89netapph700s firmware View
90netapph700s View
91netapph410s firmware View
92netapph410s View
93netappontap select deploy administration utility View
94gnuGNU C Library View
Total affected vendors: 8|Products: 94

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
7.8CVSS 3.x—CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HMicrosoft MSRC
7.8CVSS V31HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD
7.8CVSS V3_1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE CNA

Patch and Remediation Guide

Solution & Remediation Advisory

Patch verified

2 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

nvd

NVD tarafından Patch olarak etiketlenmiş referans

Open source
reference

Yama veya çözüm referansı

Open source
canonical

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Apply the official update named in the evidence only to the matching product and version.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

CVE-2023-4911 : the database holds 6 public PoC/exploit sources for it. For direct links to the sources, open the Public Exploits tab.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-4911 is associated with the following CWEs:

CWE-122: Common Weakness Enumeration Entry CWE-122CWE-787: Out-of-bounds Write

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-4911 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureYerel erişim
PermissionsLow
UserGerekmiyor

Official Sources and Advisories

RHSA-2023:5453vendor-advisoryRHSA-2023:5454vendor-advisoryRHSA-2023:5455vendor-advisoryRHSA-2023:5476vendor-advisoryRHSA-2024:0033vendor-advisoryhttps://access.redhat.com/security/cve/CVE-2023-4911vendor-advisoryRHBZ#2238352vendor-advisoryhttps://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txtvendor-advisoryhttps://www.qualys.com/cve-2023-4911/vendor-advisoryhttp://www.openwall.com/lists/oss-security/2023/10/03/3nvd

CVSS Vector Radar Chart

7.8 / 10
Attack VectorLocalComplexityLowPrivilegesLowUser Interact.NoneConfidentialityLowIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow privileges
User InteractionNone required
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama doğrulandı

2 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.

Follow the vendor

R
redhat logo
redhat
RH
Red Hat logo
Red Hat
N
netapp logo
netapp
S
siemens logo
siemens
G
gnu logo
gnu
F
fedoraproject logo
fedoraproject

Weakness Type (CWE & CAPEC)

CWE-122 CWE-787

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2023-4911"