A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
22 Feb 2024, 20:18
Type | Values Removed | Values Added |
---|---|---|
First Time |
Redhat codeready Linux Builder For Arm64 Eus
Redhat codeready Linux Builder For Power Little Endian Eus Redhat enterprise Linux For Arm 64 Eus Redhat enterprise Linux Eus Redhat enterprise Linux Server Tus Redhat codeready Linux Builder Eus Redhat enterprise Linux For Ibm Z Systems Eus S390x Redhat codeready Linux Builder For Ibm Z Systems Eus Redhat enterprise Linux For Power Big Endian Eus Redhat enterprise Linux Server Aus Redhat virtualization Host |
|
References | () http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html - Exploit, Third Party Advisory | |
References | () http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html - Exploit, Third Party Advisory | |
References | () http://seclists.org/fulldisclosure/2023/Oct/11 - Exploit, Mailing List, Third Party Advisory | |
References | () http://www.openwall.com/lists/oss-security/2023/10/13/11 - Mailing List | |
References | () http://www.openwall.com/lists/oss-security/2023/10/14/3 - Mailing List | |
References | () http://www.openwall.com/lists/oss-security/2023/10/14/5 - Mailing List | |
References | () http://www.openwall.com/lists/oss-security/2023/10/14/6 - Third Party Advisory | |
References | () https://access.redhat.com/errata/RHSA-2023:5476 - Third Party Advisory | |
References | () https://access.redhat.com/errata/RHSA-2024:0033 - Third Party Advisory | |
References | () https://security.netapp.com/advisory/ntap-20231013-0006/ - Mailing List, Third Party Advisory | |
CPE | cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:8.6_ppc64le:*:*:*:*:*:*:* |
03 Jan 2024, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
21 Dec 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
14 Oct 2023, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
14 Oct 2023, 18:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
14 Oct 2023, 12:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
14 Oct 2023, 00:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
13 Oct 2023, 22:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
06 Oct 2023, 17:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
06 Oct 2023, 06:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
05 Oct 2023, 22:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
05 Oct 2023, 16:51
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
References | (MISC) https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt - Exploit | |
References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2238352 - Issue Tracking, Patch, Third Party Advisory | |
References | (MISC) https://access.redhat.com/security/cve/CVE-2023-4911 - Third Party Advisory | |
References | (MISC) http://www.openwall.com/lists/oss-security/2023/10/05/1 - Mailing List, Third Party Advisory | |
References | (MISC) https://security.gentoo.org/glsa/202310-03 - Third Party Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/ - Exploit, Mailing List | |
References | (MISC) http://www.openwall.com/lists/oss-security/2023/10/03/2 - Exploit, Mailing List | |
References | (MISC) http://www.openwall.com/lists/oss-security/2023/10/03/3 - Mailing List, Patch | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/ - Mailing List | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/ - Mailing List | |
References | (MISC) https://www.qualys.com/cve-2023-4911/ - Third Party Advisory | |
References | (MISC) https://www.debian.org/security/2023/dsa-5514 - Third Party Advisory | |
CPE | cpe:2.3:a:gnu:glibc:-:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
|
CWE | CWE-787 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
First Time |
Fedoraproject
Gnu glibc Gnu Redhat virtualization Fedoraproject fedora Redhat Redhat enterprise Linux |
05 Oct 2023, 03:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
04 Oct 2023, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
04 Oct 2023, 10:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
03 Oct 2023, 23:55
Type | Values Removed | Values Added |
---|---|---|
References |
|
03 Oct 2023, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
03 Oct 2023, 18:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-10-03 18:15
Updated : 2024-02-22 20:18
NVD link : CVE-2023-4911
Mitre link : CVE-2023-4911
CVE.ORG link : CVE-2023-4911
JSON object : View
Products Affected
gnu
- glibc
redhat
- virtualization
- codeready_linux_builder_for_ibm_z_systems_eus
- enterprise_linux_for_arm_64_eus
- enterprise_linux_for_ibm_z_systems_eus_s390x
- codeready_linux_builder_for_power_little_endian_eus
- codeready_linux_builder_for_arm64_eus
- enterprise_linux
- enterprise_linux_server_aus
- enterprise_linux_server_tus
- enterprise_linux_eus
- virtualization_host
- codeready_linux_builder_eus
- enterprise_linux_for_power_big_endian_eus
fedoraproject
- fedora