Description
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
glibc
Default version status: unaffected
2.34 to < 2.39affected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
0:2.28-225.el8_8.6 to < *unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
0:2.28-225.el8_8.6 to < *unaffected
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
Default version status: affected
0:2.28-189.6.el8_6 to < *unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
0:2.34-60.el9_2.7 to < *unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
0:2.34-60.el9_2.7 to < *unaffected
Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
Default version status: affected
0:2.34-28.el9_0.4 to < *unaffected
Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
Default version status: affected
0:2.28-189.6.el8_6 to < *unaffected
Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
Default version status: affected
0:4.5.3-10.el8ev to < *unaffected
Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8
Default version status: affected
0:4.5.3-202312060823_8.6 to < *unaffected
Red Hat Red Hat Enterprise Linux 6
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
Red Hat Red Hat Enterprise Linux 7
Default version status: unaffected
References
- https://access.redhat.com/errata/RHSA-2023:5453 ↗
- https://access.redhat.com/errata/RHSA-2023:5454 ↗
- https://access.redhat.com/errata/RHSA-2023:5455 ↗
- https://access.redhat.com/errata/RHSA-2023:5476 ↗
- https://access.redhat.com/errata/RHSA-2024:0033 ↗
- https://access.redhat.com/security/cve/CVE-2023-4911 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352 ↗
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt ↗
- https://www.qualys.com/cve-2023-4911/ ↗
- https://www.exploit-db.com/exploits/52479 ↗
- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html ↗
- http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html ↗
- http://seclists.org/fulldisclosure/2023/Oct/11 ↗
- http://www.openwall.com/lists/oss-security/2023/10/03/2 ↗
- http://www.openwall.com/lists/oss-security/2023/10/03/3 ↗
- http://www.openwall.com/lists/oss-security/2023/10/05/1 ↗
- http://www.openwall.com/lists/oss-security/2023/10/13/11 ↗
- http://www.openwall.com/lists/oss-security/2023/10/14/3 ↗
- http://www.openwall.com/lists/oss-security/2023/10/14/5 ↗
- http://www.openwall.com/lists/oss-security/2023/10/14/6 ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/ ↗
- https://security.gentoo.org/glsa/202310-03 ↗
- https://security.netapp.com/advisory/ntap-20231013-0006/ ↗
- https://www.debian.org/security/2023/dsa-5514 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗