GNU C Library
CVE-2023-4911
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain local unprivileged shell
-
DeliveryCraft malicious GLIBC_TUNABLES value
-
ExploitInvoke SUID-root binary (e.g., su)
-
InstallTrigger heap overflow in ld.so parser
-
C2Hijack control flow before privilege drop
-
ExecuteExecute payload as root
-
ImpactEstablish persistent root access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have local code execution as any unprivileged user on a Linux host running an unpatched glibc version (2.34 through the fixed releases) that ships the GLIBC_TUNABLES feature, plus the presence of at least one SUID-root binary the attacker can execute - both conditions are met by default on virtually every mainstream Linux distribution including RHEL 8.6/9.x, Fedora 37/38/39, and NetApp Bootstrap OS. No user interaction by another user, no network exposure, and no special configuration beyond a standard Linux install are required; limiting factors are strictly the local-access prerequisite and the existence of patched glibc packages or the Red Hat systemtap mitigation on the target system. |
| Impact | Multiple independent signals concur that this is a real, high-priority issue rather than a paper risk: CISA KEV confirms active exploitation, EPSS sits at 71.53% (99th percentile), and public exploit code exists. The 7.8 CVSS reflects local attack vector with low complexity and no privileges required (any local shell user can trigger it), and technical impact is total compromise via root code execution. The CVSS vector string was not provided in the input, so the precise AV/AC/PR/UI breakdown is inferred from the description's 'local attacker' wording and the established Looney Tunables analysis - verification against the official NVD vector is recommended. Note also that EPSS measures internet-facing exploitation probability and is unusually high for a local-only flaw, suggesting it is bundled into post-exploitation toolchains rather than direct mass scanning; defenders should treat any compromised low-privilege account on an unpatched host as a likely root-escalation pivot. |
| Exploit ScenarioDerived | An attacker who has obtained an unprivileged shell on a Linux host - for example via a phishing-delivered foothold, a compromised web application, or a stolen low-privilege SSH credential - sets a maliciously crafted GLIBC_TUNABLES environment variable and invokes a common SUID-root binary such as /usr/bin/su or /usr/bin/sudo. The overflow corrupts ld.so memory before privilege drop, yielding a root shell; public exploit code (notably from Qualys and several independent researchers) automates this end-to-end in seconds, making it a standard post-exploitation step in modern Linux intrusions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected Linux distributions to gain root by abusing a heap buffer overflow when ld.so processes the GLIBC_TUNABLES environment variable during execution of SUID binaries. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 71.53% (99th percentile) reflects very high exploitation likelihood across Linux estates.
RemediationAI
Apply the vendor-released glibc patch for your distribution as the primary fix - Red Hat, Fedora, Debian, Ubuntu, SUSE, and NetApp have all shipped updated glibc packages (e.g., glibc-2.34-60.el9_2.7 on RHEL 9.2 and equivalents on other streams); consult your distribution's advisory for the exact patched NEVRA matching your release. Patching glibc typically requires a reboot or at minimum a full service restart cycle because ld.so is mapped into every running process. As an interim compensating control where patching is delayed, administrators can use systemtap or an equivalent kernel hook to terminate any process whose environment contains a GLIBC_TUNABLES value triggering the parser bug (Red Hat published a systemtap mitigation script in RHSB-2023-003) - the trade-off is added kernel-side overhead and the risk of breaking legitimate tunables usage. Reducing the SUID binary footprint (removing the SUID bit from non-essential binaries) limits attack surface but can break expected user functionality such as ping, su, or mount; this should be tested per environment before deployment.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in glibc's dynamic linker/loader (ld.so), which is invoked for nearly every dynamically linked binary on Linux and runs with the privileges of the calling binary. GLIBC_TUNABLES is an environment variable mechanism introduced to tweak runtime behavior of glibc; the parser that splits and copies tunable name=value pairs mishandles malformed input, producing a CWE-122 heap-based buffer overflow in ld.so's internal data structures. Because ld.so retains the caller's elevated privileges when launching SUID-root binaries, corrupting its memory enables hijacking control flow inside a process that has not yet dropped privileges. Affected CPE coverage includes upstream gnu:glibc, Red Hat Enterprise Linux (CodeReady Builder 8.6/9.x EUS streams), Fedora 37/38/39, and NetApp Bootstrap OS, indicating broad downstream exposure across enterprise and appliance Linux.
Know when Glibc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Executive ViewAI
A heap buffer overflow in glibc affects Linux systems across the enterprise, enabling any local user-including low-privileged accounts and container tenants-to escalate to root. Active exploitation confirmed by CISA with 71% likelihood of real-world attacks makes this an immediate priority for any organization where Linux hosts untrusted workloads. Full system compromise is possible on each affected server.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Affected Products (CPE)NVD
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,
The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
Local privilege escalation in GNU glibc 2.36 and newer arises from a heap-based buffer overflow in __vsyslog_internal, r
Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-depe
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-depende
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before th
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer ove
GNU Libc current is affected by: Mitigation bypass. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. Rated critical seve
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in
GitHub PoC