GNU C Library CVE-2023-4911
HIGHCVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
AnalysisAI
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected Linux distributions to gain root by abusing a heap buffer overflow when ld.so processes the GLIBC_TUNABLES environment variable during execution of SUID binaries. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 71.53% (99th percentile) reflects very high exploitation likelihood across Linux estates.
Technical ContextAI
The vulnerability resides in glibc's dynamic linker/loader (ld.so), which is invoked for nearly every dynamically linked binary on Linux and runs with the privileges of the calling binary. GLIBC_TUNABLES is an environment variable mechanism introduced to tweak runtime behavior of glibc; the parser that splits and copies tunable name=value pairs mishandles malformed input, producing a CWE-122 heap-based buffer overflow in ld.so's internal data structures. Because ld.so retains the caller's elevated privileges when launching SUID-root binaries, corrupting its memory enables hijacking control flow inside a process that has not yet dropped privileges. Affected CPE coverage includes upstream gnu:glibc, Red Hat Enterprise Linux (CodeReady Builder 8.6/9.x EUS streams), Fedora 37/38/39, and NetApp Bootstrap OS, indicating broad downstream exposure across enterprise and appliance Linux.
RemediationAI
Apply the vendor-released glibc patch for your distribution as the primary fix - Red Hat, Fedora, Debian, Ubuntu, SUSE, and NetApp have all shipped updated glibc packages (e.g., glibc-2.34-60.el9_2.7 on RHEL 9.2 and equivalents on other streams); consult your distribution's advisory for the exact patched NEVRA matching your release. Patching glibc typically requires a reboot or at minimum a full service restart cycle because ld.so is mapped into every running process. As an interim compensating control where patching is delayed, administrators can use systemtap or an equivalent kernel hook to terminate any process whose environment contains a GLIBC_TUNABLES value triggering the parser bug (Red Hat published a systemtap mitigation script in RHSB-2023-003) - the trade-off is added kernel-side overhead and the risk of breaking legitimate tunables usage. Reducing the SUID binary footprint (removing the SUID bit from non-essential binaries) limits attack surface but can break expected user functionality such as ping, su, or mount; this should be tested per environment before deployment.
Share
External POC / Exploit Code
Leaving vuln.today