7.8

CVE-2023-4911

Warning
Exploit

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Data is provided by the National Vulnerability Database (NVD)
Gnu ≫ Glibc Version >= 2.34 < 2.39
Fedoraproject ≫ Fedora Version37
Fedoraproject ≫ Fedora Version38
Fedoraproject ≫ Fedora Version39
Redhat ≫ Codeready Linux Builder For Arm64 Version9.0_aarch64
Redhat ≫ Virtualization Version4.0
Redhat ≫ Virtualization Host Version4.0
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Version9.0
Redhat ≫ Enterprise Linux Eus Version8.6
Redhat ≫ Enterprise Linux Eus Version9.2
Redhat ≫ Enterprise Linux Eus Version9.4
Redhat ≫ Enterprise Linux For Arm 64 Version9.0_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version8.6_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.2_aarch64
Redhat ≫ Enterprise Linux For Arm 64 Eus Version9.4_aarch64
Canonical ≫ Ubuntu Linux Version22.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version23.04
Debian ≫ Debian Linux Version11.0
Debian ≫ Debian Linux Version12.0
Netapp ≫ H410c Firmware Version-
   Netapp ≫ H410c Version-
Netapp ≫ H300s Firmware Version-
   Netapp ≫ H300s Version-
Netapp ≫ H500s Firmware Version-
   Netapp ≫ H500s Version-
Netapp ≫ H700s Firmware Version-
   Netapp ≫ H700s Version-
Netapp ≫ H410s Firmware Version-
   Netapp ≫ H410s Version-

21.11.2023: CISA Known Exploited Vulnerabilities (KEV) Catalog

GNU C Library Buffer Overflow Vulnerability

Vulnerability

GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

Description

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 78.36% 0.99
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
secalert@redhat.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122 Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

http://seclists.org/fulldisclosure/2023/Oct/11
Third Party Advisory
Exploit
Mailing List