Skip to content

CVE-2023-4911: glibc

Title

CVE-2023-4911: glibc: Looney Tunables: buffer overflow in ld.so leading to privilege escalation

Summary

As described by Red Hat and in CVE-2023-4911:

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

More detail is available in the public disclosure by Qualys, the team who discovered the issue.

Public disclosure date: October 3, 2023

EL9

  • Mitigated in version: 2.34-60.el9_2.security.0.2 available October 3, 2023
  • Fixed in version: glibc-2.34-60.el9_2.7 available October 5, 2023

Besides the upstream fix, we also retained the mitigation in our override package of glibc.

EL8

  • Fixed in version: glibc-0:2.28-225.el8_8.6 available October 5, 2023
  • Errata: RLSA-2023:5455 issued October 7, 2023