CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability

CVE-2023-4911 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2023-10-03

A security vulnerability has been identified in the GNU C Library (glibc), a core component of almost all Linux-based operating systems. This flaw allows a local user to gain full administrative (root) privileges by exploiting how the system handles certain environment variables when starting programs. An attacker with basic access to a system could use this to take complete control of the machine, potentially leading to data theft or persistent unauthorized access.

Technologies: Gnu Glibc, GNU C Library, Red Hat Enterprise Linux 8.0, Red Hat Enterprise Linux 9.0. Vendors: Gnu, Red Hat.

Quick answers

Is CVE-2023-4911 exploited in the wild?
Yes. CVE-2023-4911 is known to be exploited in the wild, first recorded on 21 November 2023. Treat it as urgent.
How severe is CVE-2023-4911?
Critical severity, with a CVSS score of 7.8, published 3 October 2023.
Which products and versions are affected?
Gnu Glibc All versions including 2.34 through 2.37.
Is there a fix for CVE-2023-4911?
A patch was published on 2023-10-05: Red Hat released security updates (RHSA-2023:5453) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-4911 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2023-4911?
Check whether you run Gnu Glibc, GNU C Library, Red Hat Enterprise Linux 8.0 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer overflow vulnerability (CWE-787/CWE-122) exists in the GNU C Library (glibc) dynamic loader, ld.so, specifically within the processing of the GLIBC_TUNABLES environment variable. When parsing malformed tunables, the loader can miscalculate the required buffer size, leading to a heap-based buffer overflow. A local attacker can exploit this by executing SUID-privileged binaries with a specially crafted GLIBC_TUNABLES string to overwrite memory and achieve arbitrary code execution with root privileges. The vulnerability is reachable without user interaction and has been confirmed to affect major Linux distributions including Red Hat Enterprise Linux, Debian, and Fedora. Patches are available from major vendors.

Affected products

  • GNU glibc All versions including 2.34 through 2.37
  • Red Hat Enterprise Linux 8.0
  • Red Hat Enterprise Linux 9.0
  • Debian Debian GNU/Linux
  • Fedora Project Fedora

Timeline

  • 2023-10-03: disclosed: Vulnerability disclosed by Qualys Research Team
  • 2023-10-03: advisory: Initial NVD publication
  • 2023-10-05: patched: Red Hat released security updates (RHSA-2023:5453)
  • 2023-11-21: kev added: CISA added to Known Exploited Vulnerabilities catalog

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.