CVE-2023-4911
GNU C Library Buffer Overflow Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 12 December 2023). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 63.77% probability · 99th percentile
- Public exploits
- 1 in Exploit-DB · first 11 February 2026
- CISA KEV
- Listed 21 November 2023 · due 12 December 2023
- Weakness
- CWE-122, CWE-787
- Affected
- netapp/bootstrap os · siemens/simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware · siemens/simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware · siemens/siplus s7-1500 cpu 1518-4 pn\/dp mfp firmware · siemens/simatic s7-1500 tm mfp firmware · gnu/glibc · fedoraproject/fedora · redhat/codeready linux builder · redhat/codeready linux builder eus · redhat/codeready linux builder for arm64 · redhat/codeready linux builder for arm64 eus · redhat/codeready linux builder for ibm z systems · redhat/codeready linux builder for ibm z systems eus · redhat/codeready linux builder for power little endian · redhat/codeready linux builder for power little endian eus · redhat/virtualization · redhat/virtualization host · redhat/enterprise linux · redhat/enterprise linux eus · redhat/enterprise linux for arm 64 · +19 more
- Source
- secalert@redhat.com
EPSS moved from 63.8% on 4 October 2026 to 63.8% on 30 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
CISA notes
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa, https://access.redhat.com/security/cve/cve-2023-4911, https://www.debian.org/security/2023/dsa-5514 ; https://nvd.nist.gov/vuln/detail/CVE-2023-4911
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- https://access.redhat.com/errata/RHSA-2023:5453Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5454Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5476Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:0033Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-4911Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352Issue Tracking, Patch
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txtExploit, Third Party Advisory
- https://www.qualys.com/cve-2023-4911/Third Party Advisory
- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2023/Oct/11Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/10/03/2Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/03/3Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/05/1Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/13/11Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/3Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/5Mailing List
- http://www.openwall.com/lists/oss-security/2023/10/14/6Mailing List
- https://access.redhat.com/errata/RHSA-2023:5453Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5454Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5455Third Party Advisory
- https://access.redhat.com/errata/RHSA-2023:5476Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:0033Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2023-4911Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352Issue Tracking, Patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/Mailing List
- https://security.gentoo.org/glsa/202310-03Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.