CVE-2023-4911

HIGHScheduled

Published:Oct 3, 2023(2 years ago)

Modified:Feb 13, 2026

Local AccessNo InteractionLow Complexity

Vulnerability Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Attack Characteristics

Local AccessLow ComplexityLow PrivilegesNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

No Fix Known

No patch has been released yet. Apply workarounds or mitigations where available.

Affected Software

Vendor	Product	Versions	Fixed In
netapp	bootstrap_os	-	-
gnu	glibc	2.34 - 2.39	-
fedoraproject	fedora	-

Timeline

Published
CVE disclosed publicly
Oct 3, 20232 years ago
Last Modified
Most recent update
Feb 13, 20263 months ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20261 month ago

References

https://access.redhat.com/errata/RHSA-2023:5453Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:5454Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:5455Third Party Advisory

CVSS Score

v3.1

7.8/ 10.0

HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

At a Glance

Affected Products

References

netapp / bootstrap_os

https://access.redhat.com/errata/RHSA-2023:5476Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:0033Third Party Advisory

https://access.redhat.com/security/cve/CVE-2023-4911Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2238352Issue Tracking

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-...Exploit

https://www.qualys.com/cve-2023-4911/Third Party Advisory

http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privileg...Exploit

http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-E...Exploit

http://seclists.org/fulldisclosure/2023/Oct/11Exploit

http://www.openwall.com/lists/oss-security/2023/10/03/2Exploit

http://www.openwall.com/lists/oss-security/2023/10/03/3Mailing List

http://www.openwall.com/lists/oss-security/2023/10/05/1Mailing List

http://www.openwall.com/lists/oss-security/2023/10/13/11Mailing List

http://www.openwall.com/lists/oss-security/2023/10/14/3Mailing List

http://www.openwall.com/lists/oss-security/2023/10/14/5Mailing List

http://www.openwall.com/lists/oss-security/2023/10/14/6Mailing List

https://access.redhat.com/errata/RHSA-2023:5453Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:5454Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:5455Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:5476Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:0033Third Party Advisory

https://access.redhat.com/security/cve/CVE-2023-4911Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2238352Issue Tracking

https://lists.fedoraproject.org/archives/list/package-announce@lists.f...Mailing List

https://security.gentoo.org/glsa/202310-03Third Party Advisory

https://security.netapp.com/advisory/ntap-20231013-0006/Third Party Advisory

https://www.debian.org/security/2023/dsa-5514Mailing List

https://www.exploit-db.com/exploits/52479Exploit

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-...Exploit

https://www.qualys.com/cve-2023-4911/Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve...US Government Resource

CVSS v3 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

Impact

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

Impact Analysis

ConfidentialityHigh

NoneLowHigh

IntegrityHigh

NoneLowHigh

AvailabilityHigh

NoneLowHigh

CVE-2023-4911

✦ Vulnerability Description

Attack Characteristics

Affected Software

Timeline

References

CVSS Score

At a Glance

Official Sources

CVSS v3 Vector

Impact Analysis

Vulnerability Description