{"id":"CVE-2023-4911","title":"A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable","summary":"A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variable…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-122","CWE-787"],"vendor":"gnu","product":"glibc","affected":["bootstrap_os","simatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware >= 3.1.5","simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware >= 3.1.5","siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware >= 3.1.5","simatic_s7-1500_tm_mfp_firmware < 1.1","glibc >= 2.34, < 2.39","fedora = 37","fedora = 38","fedora = 39","codeready_linux_builder = 9.0","codeready_linux_builder_eus = 8.6","codeready_linux_builder_eus = 9.2","codeready_linux_builder_eus = 9.4","codeready_linux_builder_eus = 9.6","codeready_linux_builder_for_arm64 = 9.0_aarch64","codeready_linux_builder_for_arm64_eus = 8.6","codeready_linux_builder_for_arm64_eus = 9.2_aarch64","codeready_linux_builder_for_arm64_eus = 9.4_aarch64","codeready_linux_builder_for_arm64_eus = 9.6_aarch64","codeready_linux_builder_for_ibm_z_systems = 9.0_s390x","codeready_linux_builder_for_ibm_z_systems_eus = 8.6","codeready_linux_builder_for_ibm_z_systems_eus = 9.2_s390x","codeready_linux_builder_for_ibm_z_systems_eus = 9.4_s390x","codeready_linux_builder_for_ibm_z_systems_eus = 9.6_s390x","codeready_linux_builder_for_power_little_endian = 9.0_ppc64le","codeready_linux_builder_for_power_little_endian_eus = 8.6","codeready_linux_builder_for_power_little_endian_eus = 9.2_ppc64le","codeready_linux_builder_for_power_little_endian_eus = 9.4_ppc64le","codeready_linux_builder_for_power_little_endian_eus = 9.6_ppc64le","virtualization = 4.0","virtualization_host = 4.0","enterprise_linux = 8.0","enterprise_linux = 9.0","enterprise_linux_eus = 8.6","enterprise_linux_eus = 9.2","enterprise_linux_eus = 9.4","enterprise_linux_eus = 9.6","enterprise_linux_for_arm_64 = 9.0_aarch64","enterprise_linux_for_arm_64_eus = 8.6_aarch64","enterprise_linux_for_arm_64_eus = 9.2_aarch64","enterprise_linux_for_arm_64_eus = 9.4_aarch64","enterprise_linux_for_arm_64_eus = 9.6_aarch64","enterprise_linux_for_ibm_z_systems = 9.0_s390x","enterprise_linux_for_ibm_z_systems_eus = 9.2_s390x","enterprise_linux_for_ibm_z_systems_eus = 9.4_s390x","enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x","enterprise_linux_for_ibm_z_systems_eus_s390x = 8.6","enterprise_linux_for_power_big_endian_eus = 8.6_ppc64le","enterprise_linux_for_power_little_endian = 9.0_ppc64le","enterprise_linux_for_power_little_endian_eus = 9.2_ppc64le","enterprise_linux_for_power_little_endian_eus = 9.4_ppc64le","enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le","enterprise_linux_server_aus = 8.6","enterprise_linux_server_aus = 9.2","enterprise_linux_server_aus = 9.4","enterprise_linux_server_aus = 9.6","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.2_ppc64le","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.4_ppc64le","enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64le","enterprise_linux_server_tus = 8.6","enterprise_linux_update_services_for_sap_solutions = 9.2","enterprise_linux_update_services_for_sap_solutions = 9.4","enterprise_linux_update_services_for_sap_solutions = 9.6","ubuntu_linux = 22.04","ubuntu_linux = 23.04","debian_linux = 11.0","debian_linux = 12.0","h410c_firmware","h300s_firmware","h500s_firmware","h700s_firmware","h410s_firmware","ontap_select_deploy_administration_utility"],"patched":["simatic_s7-1500_tm_mfp_firmware 1.1","glibc 2.39"],"published":"2023-10-03","updated":"2026-10-14","sourceUpdated":"2026-10-14T22:17:18.373","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-4911","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:5453","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:5454","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:5455","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:5476","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2024:0033","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2023-4911","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238352","label":"secalert@redhat.com"},{"url":"https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt","label":"secalert@redhat.com"},{"url":"https://www.qualys.com/cve-2023-4911/","label":"secalert@redhat.com"},{"url":"http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://seclists.org/fulldisclosure/2023/Oct/11","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/03/2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/03/3","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/05/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/13/11","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/14/3","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/14/5","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2023/10/14/6","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:5453","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:5454","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:5455","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:5476","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2024:0033","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/security/cve/CVE-2023-4911","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238352","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202310-03","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20231013-0006/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2023/dsa-5514","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/52479","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.qualys.com/cve-2023-4911/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-831302.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","exploit-available","cve.org"],"epss":0.63769,"epssPercentile":0.99214,"kev":true,"kevDateAdded":"2023-11-21","kevDueDate":"2023-12-12","kevRansomware":false,"exploited":true,"exploits":{"exploitdb":true,"github":21,"githubRepos":["https://github.com/Green-Avocado/CVE-2023-4911","https://github.com/leesh3288/CVE-2023-4911","https://github.com/RickdeJager/CVE-2023-4911"],"metasploit":["exploit/linux/local/glibc_tunables_priv_esc"],"checkedAt":"2026-10-14T23:00:36.689Z"},"exploitAvailable":true,"ingestedAt":"2026-10-14T23:00:02.005Z","ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2025-10-15T19:45:35.724824Z"},"slug":"CVE-2023-4911","body":"## Overview\n\nA buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.\n\n## Affected\n\n- `bootstrap_os`\n- `simatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware >= 3.1.5`\n- `simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware >= 3.1.5`\n- `siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware >= 3.1.5`\n- `simatic_s7-1500_tm_mfp_firmware < 1.1`\n- `glibc >= 2.34, < 2.39`\n- `fedora = 37`\n- `fedora = 38`\n- `fedora = 39`\n- `codeready_linux_builder = 9.0`\n- `codeready_linux_builder_eus = 8.6`\n- `codeready_linux_builder_eus = 9.2`\n- `codeready_linux_builder_eus = 9.4`\n- `codeready_linux_builder_eus = 9.6`\n- `codeready_linux_builder_for_arm64 = 9.0_aarch64`\n- `codeready_linux_builder_for_arm64_eus = 8.6`\n- `codeready_linux_builder_for_arm64_eus = 9.2_aarch64`\n- `codeready_linux_builder_for_arm64_eus = 9.4_aarch64`\n- `codeready_linux_builder_for_arm64_eus = 9.6_aarch64`\n- `codeready_linux_builder_for_ibm_z_systems = 9.0_s390x`\n- `codeready_linux_builder_for_ibm_z_systems_eus = 8.6`\n- `codeready_linux_builder_for_ibm_z_systems_eus = 9.2_s390x`\n- `codeready_linux_builder_for_ibm_z_systems_eus = 9.4_s390x`\n- `codeready_linux_builder_for_ibm_z_systems_eus = 9.6_s390x`\n- `codeready_linux_builder_for_power_little_endian = 9.0_ppc64le`\n- `codeready_linux_builder_for_power_little_endian_eus = 8.6`\n- `codeready_linux_builder_for_power_little_endian_eus = 9.2_ppc64le`\n- `codeready_linux_builder_for_power_little_endian_eus = 9.4_ppc64le`\n- `codeready_linux_builder_for_power_little_endian_eus = 9.6_ppc64le`\n- `virtualization = 4.0`\n- `virtualization_host = 4.0`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `enterprise_linux_eus = 8.6`\n- `enterprise_linux_eus = 9.2`\n- `enterprise_linux_eus = 9.4`\n- `enterprise_linux_eus = 9.6`\n- `enterprise_linux_for_arm_64 = 9.0_aarch64`\n- `enterprise_linux_for_arm_64_eus = 8.6_aarch64`\n- `enterprise_linux_for_arm_64_eus = 9.2_aarch64`\n- `enterprise_linux_for_arm_64_eus = 9.4_aarch64`\n- `enterprise_linux_for_arm_64_eus = 9.6_aarch64`\n- `enterprise_linux_for_ibm_z_systems = 9.0_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 9.2_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 9.4_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus = 9.6_s390x`\n- `enterprise_linux_for_ibm_z_systems_eus_s390x = 8.6`\n- `enterprise_linux_for_power_big_endian_eus = 8.6_ppc64le`\n- `enterprise_linux_for_power_little_endian = 9.0_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 9.2_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 9.4_ppc64le`\n- `enterprise_linux_for_power_little_endian_eus = 9.6_ppc64le`\n- `enterprise_linux_server_aus = 8.6`\n- `enterprise_linux_server_aus = 9.2`\n- `enterprise_linux_server_aus = 9.4`\n- `enterprise_linux_server_aus = 9.6`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.2_ppc64le`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.4_ppc64le`\n- `enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64le`\n- `enterprise_linux_server_tus = 8.6`\n- `enterprise_linux_update_services_for_sap_solutions = 9.2`\n- `enterprise_linux_update_services_for_sap_solutions = 9.4`\n- `enterprise_linux_update_services_for_sap_solutions = 9.6`\n- `ubuntu_linux = 22.04`\n- `ubuntu_linux = 23.04`\n- `debian_linux = 11.0`\n- `debian_linux = 12.0`\n- `h410c_firmware`\n- `h300s_firmware`\n- `h500s_firmware`\n- `h700s_firmware`\n- `h410s_firmware`\n- `ontap_select_deploy_administration_utility`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `simatic_s7-1500_tm_mfp_firmware 1.1`\n- `glibc 2.39`","depth":"abyssal","depthScore":81,"depthScoreParts":{"impact":42.9,"likelihood":12.8,"exploitation":25,"ransomware":0},"changes":[]}