# CVE-2023-4911: Glibc: buffer overflow in ld.so leading to privilege escalation

Status: published. Published: 2023-10-03. Updated: 2026-11-07.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

## Remediation

- workaround: For customers who cannot update immediately and do not have Secure Boot feature enabled, the issue can be mitigated using the provided SystemTap script with the following steps.  When enabled, any setuid program invoked with GLIBC_TUNABLES in the environment will be terminated immediately.  To invoke the setuid program, users will then have to unset or clear the GLIBC_TUNABLES envvar, e.g. `GLIBC_TUNABLES= sudo` . 

Note that these mitigation steps will need to be repeated if the system is rebooted.

1)    Install required systemtap packages and dependencies as per - https://access.redhat.com/solutions/5441


2)    Create the following systemtap script, and name it stap_block_suid_tunables.stp:
    ~~~
function has_tunable_string:long()
{
  name = "GLIBC_TUNABLES"

  mm = @task(task_current())->mm;
  if (mm)
    {
      env_start = @mm(mm)->env_start;
      env_end = @mm(mm)->env_end;

      if (env_start != 0 && env_end != 0)
        while (env_end > env_start)
          {
            cur = user_string(env_start, "");
            env_name = tokenize(cur, "=");
      
            if (env_name == name && tokenize("", "") != "")
              return 1;
            env_start += strlen (cur) + 1
          }
    }

  return 0;
}

probe process("/lib*/ld*.so*").function("__tunables_init")
{
  atsecure = 0;
  /* Skip processing if we can't read __libc_enable_secure, e.g. core dump
     handler (systemd-cgroups-agent and systemd-coredump).  */
  try { atsecure = @var("__libc_enable_secure"); }
  catch { printk (4, sprintf ("CVE-2023-4911: Skipped check: %s (%d)", execname(), pid())); }
  if (atsecure && has_tunable_string ())
    raise (9);
}
~~~

3) Load the systemtap module into the running kernel:
    ~~~
    stap -g -F -m stap_block_suid_tunables stap_block_suid_tunables.stp
    ~~~

4) Ensure the module is loaded:
    ~~~
     lsmod | grep -i stap_block_suid_tunables
stap_block_suid_tunables     249856  0
~~~

5) Once the glibc package is updated to the version containing the fix, the systemtap generated kernel module can be removed by running:
    ~~~
    rmmod stap_block_suid_tunables
    ~~~

If Secure Boot is enabled on a system, the SystemTap module must be signed. An external compiling server can be used to sign the generated kernel module with a key enrolled into the kernel's keyring or starting with SystemTap 4.7 you can sign a module without a compile server. See further information here - https://www.redhat.com/sysadmin/secure-boot-systemtap (source: CNA: redhat)

## Affected products and versions

-  /  (glibc): ≥ 2.34; < 2.39 (affected, custom). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (glibc): ≥ 0:2.28-225.el8_8.6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support (glibc): ≥ 0:2.28-189.6.el8_6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (glibc): ≥ 0:2.34-60.el9_2.7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.0 Extended Update Support (glibc): ≥ 0:2.34-28.el9_0.4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 (glibc): ≥ 0:2.28-189.6.el8_6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 (redhat-release-virtualization-host): ≥ 0:4.5.3-10.el8ev; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 (redhat-virtualization-host): ≥ 0:4.5.3-202312060823_8.6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (glibc): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (compat-glibc): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (glibc): Version range not reported. Source: CNA: redhat
- Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: ≥ V3.1.5; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP: ≥ V3.1.5; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 TM MFP - GNU/Linux subsystem: ≥ 0; < V1.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFP: ≥ V3.1.5; < * (affected, custom). Source: ADP: siemens-SADP

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat

- CISA KEV: listed; Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.; due 2023-12-12

- EPSS: 63.77% as of 2026-11-06; percentile 99.22%

- SSVC: exploitation active; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-122

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2023:5453 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2023:5454 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2023:5455 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2023:5476 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2024:0033 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2023-4911 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2238352 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt (CNA: redhat)

- https://www.qualys.com/cve-2023-4911/ (CNA: redhat)

- https://www.exploit-db.com/exploits/52479 (ADP: CVE)

- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html (ADP: CVE; x_transferred)

- http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html (ADP: CVE; x_transferred)

- http://seclists.org/fulldisclosure/2023/Oct/11 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2023/10/03/2 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2023/10/03/3 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2023/10/05/1 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2023/10/13/11 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2023/10/14/3 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2023/10/14/5 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2023/10/14/6 (ADP: CVE; x_transferred)

- https://access.redhat.com/errata/RHSA-2023:5453 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2023:5454 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2023:5455 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2023:5476 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2024:0033 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/security/cve/CVE-2023-4911 (ADP: CVE; vdb-entry, x_refsource_REDHAT, x_transferred)

- https://bugzilla.redhat.com/show_bug.cgi?id=2238352 (ADP: CVE; issue-tracking, x_refsource_REDHAT, x_transferred)

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/ (ADP: CVE; x_transferred)

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/ (ADP: CVE; x_transferred)

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/ (ADP: CVE; x_transferred)

- https://security.gentoo.org/glsa/202310-03 (ADP: CVE; x_transferred)

- https://security.netapp.com/advisory/ntap-20231013-0006/ (ADP: CVE; x_transferred)

- https://www.debian.org/security/2023/dsa-5514 (ADP: CVE; x_transferred)

- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt (ADP: CVE; x_transferred)

- https://www.qualys.com/cve-2023-4911/ (ADP: CVE; x_transferred)

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911 (ADP: CISA-ADP; government-resource)

- https://cert-portal.siemens.com/productcert/html/ssa-831302.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-794697.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-082556.html (ADP: siemens-SADP)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2023-4911; retrieved 2026-11-07; source updated 2026-11-07

- CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog; retrieved 2026-11-02; source updated Not reported

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2023-4911; retrieved 2026-11-07; source updated Not reported

Revision: 44f3ec1d5adad8f9a81a7615f7ae26139a921e81d45fe297da3440edbfc2f272

Canonical: https://y2.dev/cve/CVE-2023-4911

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.