CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability

Vulnerability summary

CVE-2023-4911 is a high (CVSS 7.8) Heap-based Buffer Overflow vulnerability in GNU GNU C Library. It is known to be exploited: CISA lists it, first on 21-11-2023. EPSS estimates a 63.77% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 7 public exploits are recorded.

Timeline

1. 03-10-2023
   PublishedVulnerability first disclosed.
2. 21-11-2023
   Added to CISA KEVExploitedGNU C Library Buffer Overflow Vulnerability
3. 12-12-2023
   CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 14-10-2026
   Last modifiedVulnerability information updated.

Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

• CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.