CVE-2023-4911
GNU C Library Buffer Overflow Vulnerability
Description
CVE-2023-4911, known as "Looney Tunables," is a HIGH severity buffer overflow vulnerability in the GNU C Library (glibc) dynamic loader (ld.so), rated 7.8 on the CVSSv3.1 scale. The flaw occurs during the processing of the GLIBC_TUNABLES environment variable and allows a local attacker to achieve privilege escalation to root by launching SUID binaries with a specially crafted environment. Virtually every Linux system uses glibc, making this vulnerability extremely widespread across distributions including Red Hat Enterprise Linux, Fedora, Debian, Ubuntu, and many others. The EPSS score of 0.5716 (98th percentile) and KEV inclusion confirm active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| netapp | bootstrap os | - |
| siemens | simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware | >= 3.1.5 |
| siemens | simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware | >= 3.1.5 |
| siemens | siplus s7-1500 cpu 1518-4 pn\/dp mfp firmware | >= 3.1.5 |
| siemens | simatic s7-1500 tm mfp firmware | < 1.1 |
| gnu | glibc | >= 2.34, < 2.39 |
| fedoraproject | fedora | 37; 38; 39 |
| redhat | codeready linux builder | 9.0 |
| redhat | codeready linux builder eus | 8.6; 9.2; 9.4; 9.6 |
| redhat | codeready linux builder for arm64 | 9.0_aarch64 |
| redhat | codeready linux builder for arm64 eus | 8.6; 9.2_aarch64; 9.4_aarch64; 9.6_aarch64 |
| redhat | codeready linux builder for ibm z systems | 9.0_s390x |
| redhat | codeready linux builder for ibm z systems eus | 8.6; 9.2_s390x; 9.4_s390x; 9.6_s390x |
| redhat | codeready linux builder for power little endian | 9.0_ppc64le |
| redhat | codeready linux builder for power little endian eus | 8.6; 9.2_ppc64le; 9.4_ppc64le; 9.6_ppc64le |
| redhat | virtualization | 4.0 |
| redhat | virtualization host | 4.0 |
| redhat | enterprise linux | 8.0; 9.0 |
| redhat | enterprise linux eus | 8.6; 9.2; 9.4; 9.6 |
| redhat | enterprise linux for arm 64 | 9.0_aarch64 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://access.redhat.com/errata/RHSA-2023:5453(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2023:5454(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2023:5455(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2023:5476(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2024:0033(Third Party Advisory)
- https://access.redhat.com/security/cve/CVE-2023-4911(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352(Issue Tracking, Patch)
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt(Exploit, Third Party Advisory)
- https://www.qualys.com/cve-2023-4911/(Third Party Advisory)
- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2023/Oct/11(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2023/10/03/2(Exploit, Mailing List)
- http://www.openwall.com/lists/oss-security/2023/10/03/3(Mailing List)
- http://www.openwall.com/lists/oss-security/2023/10/05/1(Mailing List)
- http://www.openwall.com/lists/oss-security/2023/10/13/11(Mailing List)
- http://www.openwall.com/lists/oss-security/2023/10/14/3(Mailing List)
- http://www.openwall.com/lists/oss-security/2023/10/14/5(Mailing List)
- http://www.openwall.com/lists/oss-security/2023/10/14/6(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/(Mailing List)
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/(Mailing List)
- https://security.gentoo.org/glsa/202310-03(Third Party Advisory)
- https://security.netapp.com/advisory/ntap-20231013-0006/(Third Party Advisory)
- https://www.debian.org/security/2023/dsa-5514(Mailing List)
- https://www.exploit-db.com/exploits/52479(Exploit, Third Party Advisory, VDB Entry)
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html(Third Party Advisory)
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911(US Government Resource)
Weakness Type
CWE-122: Heap-Based Buffer Overflow / CWE-787: Out-of-Bounds Write
CVE-2023-4911 involves two related memory safety weaknesses:
CWE-122: Heap-Based Buffer Overflow — A buffer overflow occurring in heap-allocated memory. The glibc dynamic loader allocates a buffer to process GLIBC_TUNABLES environment variable values on the heap. When the variable contains a maliciously crafted value, the parser overflows this heap buffer, writing attacker-controlled data beyond its boundary.
CWE-787: Out-of-Bounds Write — The overflow constitutes an out-of-bounds write, where data is written past the end of the allocated buffer. In the context of ld.so processing privileged SUID binaries, this out-of-bounds write can corrupt adjacent heap structures in ways that redirect execution flow, ultimately enabling the attacker to execute arbitrary code with root privileges.
Impact Analysis
CVE-2023-4911 poses a HIGH severity risk primarily due to its local privilege escalation impact — all three dimensions (confidentiality, integrity, availability) are rated HIGH, reflecting the ability to gain full root access on a vulnerable system. The attack vector is local, meaning an attacker must already have unprivileged access to the target system (a standard user account is sufficient). Attack complexity is low and no special privileges beyond a local account are required. While the local attack vector limits network-based exploitation, this is a critical vulnerability for scenarios involving shared hosting, container escape, malware establishing persistence with elevated privileges, or post-exploitation lateral movement within Linux environments. Systems exposed to untrusted local users — such as multi-tenant servers, HPC clusters, or Linux desktops — face the highest risk.
Exploit Maturity
CVE-2023-4911 achieved an EPSS score of 0.5716 (98th percentile), indicating very high exploitation probability relative to all CVEs. Public proof-of-concept exploit code was released within days of the October 3, 2023 disclosure, and multiple threat actors were observed exploiting the vulnerability to gain root privileges on unpatched Linux systems. CISA added it to the KEV catalog with a December 12, 2023 remediation deadline. The combination of a trivially triggered vulnerability in a ubiquitous library (glibc), reliable public exploits, and broad platform coverage across all major Linux distributions made "Looney Tunables" one of the most quickly and widely exploited local privilege escalation vulnerabilities of 2023.
Remediation
- Apply distribution patches immediately: Install updated glibc packages from your Linux distribution. Red Hat Enterprise Linux users should apply RHSA-2023:5453 through RHSA-2023:5476 (version-specific). Fedora users should install the updated
glibcpackages viadnf update glibc. Debian and Ubuntu users should apply the corresponding security updates. - Verify patch application: After patching, confirm the installed glibc version is no longer vulnerable by checking
ldd --versionand comparing against your distribution's fixed release notes. - Prioritize internet-facing and multi-user systems: Systems with multiple local user accounts (shared servers, VMs, containers with shell access) should be patched first due to the local privilege escalation nature of the exploit.
- Monitor for exploitation: Review audit logs for unusual SUID binary invocations, unexpected privilege changes, or modifications to
/etc/passwd,/etc/shadow, or sudoers files that could indicate post-exploitation activity. - Apply CISA KEV guidance: Per the KEV catalog, apply mitigations per vendor instructions by December 12, 2023 or discontinue use of the affected product.
- Update container base images: Docker and container environments based on vulnerable glibc versions must rebuild base images with patched glibc packages — container runtime isolation does not prevent exploitation of this local privilege escalation.
Technical Details
CVE-2023-4911 ("Looney Tunables") is a heap-based buffer overflow in the glibc dynamic loader (ld.so) that occurs during parsing of the GLIBC_TUNABLES environment variable. The GLIBC_TUNABLES mechanism allows users to configure glibc behavior at runtime through environment variables (e.g., GLIBC_TUNABLES=glibc.malloc.check=3). The dynamic loader processes these variables early in program startup, before the runtime environment is fully established. The flaw lies in the parsing logic: when the loader processes a maliciously crafted GLIBC_TUNABLES value, it does not properly validate lengths before copying data, resulting in a heap buffer overflow (CWE-122, CWE-787). The overflow corrupts heap metadata or function pointers in adjacent allocations within the ld.so process. Crucially, ld.so is invoked for every execution of a SUID binary (binaries with the Set-User-ID bit set, which execute with the file owner's privileges rather than the caller's). By setting a crafted GLIBC_TUNABLES value and invoking any SUID-root binary (such as /usr/bin/sudo, /usr/bin/pkexec, or /usr/bin/passwd), a local attacker can trigger the overflow in a context where ld.so runs with root privileges, enabling privilege escalation to root. The CVSSv3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects the local, low-complexity, low-privilege nature of the attack. Affected glibc versions span all major Linux distributions; Docker containers created after February 2023 using affected base images are also vulnerable if not rebuilt with patched glibc packages.
Frequently Asked Questions
Which Linux distributions are affected by CVE-2023-4911 (Looney Tunables)?
Virtually all major Linux distributions that use glibc are affected, including Red Hat Enterprise Linux (6, 7, 8, 9), Fedora, Debian, Ubuntu, CentOS Stream, and any derivatives. NetApp systems using BootstrapOS with glibc are also listed as affected. Alpine Linux (which uses musl libc instead of glibc) is not affected.
Why is a local vulnerability rated so highly?
While the local attack vector requires existing system access, the impact of root privilege escalation is complete — an attacker gains full control of the operating system, including access to all files, processes, and credentials. In cloud and enterprise environments, many attack scenarios begin with limited access (e.g., a phishing email leading to a low-privilege shell), making local privilege escalation vulnerabilities critical for containing the blast radius of initial compromises.
Is it enough to update glibc to fix CVE-2023-4911?
Yes, applying the patched glibc packages from your Linux distribution resolves the vulnerability. However, container environments using fixed base images at build time must rebuild their container images with the updated glibc — updating packages on the host alone does not fix containers using older base images with the vulnerable library.
Was public exploit code released for CVE-2023-4911?
Yes. Proof-of-concept exploit code for CVE-2023-4911 was publicly released within days of the October 3, 2023 disclosure by Qualys, who discovered and reported the vulnerability. The ready availability of reliable exploit code contributed to rapid widespread exploitation, as reflected in the 98th-percentile EPSS score and CISA KEV listing.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.