CVE-2023-4911
HIGHCVSS 7.8Known ExploitedCISA Known Exploited Vulnerability
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa, https://access.redhat.com/security/cve/cve-2023-4911, https://www.debian.org/security/2023/dsa-5514 ; https://nvd.nist.gov/vuln/detail/CVE-2023-4911
Remediation deadline: December 12, 2023
Description
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
Timeline
Published:October 3rd, 2023 6:15 PM
Last modified:October 14th, 2026 10:17 PM
Added to KEV:November 21st, 2023
CVSS Scoring
CVSS v3: 7.8 (HIGH)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
From NVD CPE configuration data
Vendors
netappsiemensgnufedoraprojectredhatcanonicaldebian
Products
bootstrap_ossimatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmwaresimatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmwaresiplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmwaresimatic_s7-1500_tm_mfp_firmwareglibcfedoracodeready_linux_buildercodeready_linux_builder_euscodeready_linux_builder_for_arm64codeready_linux_builder_for_arm64_euscodeready_linux_builder_for_ibm_z_systemscodeready_linux_builder_for_ibm_z_systems_euscodeready_linux_builder_for_power_little_endiancodeready_linux_builder_for_power_little_endian_eusvirtualizationvirtualization_hostenterprise_linuxenterprise_linux_eusenterprise_linux_for_arm_64
References & Reports
Advisories, patches, and third-party reports
- https://access.redhat.com/errata/RHSA-2023:5453Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5454Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5476Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:0033Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-4911Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352Issue Tracking
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txtExploit
- https://www.qualys.com/cve-2023-4911/Third Party Advisory
- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.htmlExploit
- http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.htmlExploit
- http://seclists.org/fulldisclosure/2023/Oct/11Exploit
- http://www.openwall.com/lists/oss-security/2023/10/03/2Exploit
- http://www.openwall.com/lists/oss-security/2023/10/03/3Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/05/1Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/13/11Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/3Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/5Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/6Mailing List
- https://access.redhat.com/errata/RHSA-2023:5453Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5454Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5476Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:0033Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-4911Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352Issue Tracking
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/Mailing List
- https://security.gentoo.org/glsa/202310-03Third Party Advisory
- https://security.netapp.com/advisory/ntap-20231013-0006/Third Party Advisory
- https://www.debian.org/security/2023/dsa-5514Mailing List
- https://www.exploit-db.com/exploits/52479Exploit
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txtExploit
- https://www.qualys.com/cve-2023-4911/Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-794697.htmlThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-831302.htmlThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911US Government Resource
Source: NIST NVD · Data may lag official sources by up to one minute