Detections
Analytics
CVE-2023-4911
high
Description
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
References
https://security.netapp.com/advisory/ntap-20231013-0006/
https://security.gentoo.org/glsa/202310-03
https://cert-portal.siemens.com/productcert/html/ssa-831302.html
https://cert-portal.siemens.com/productcert/html/ssa-794697.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://access.redhat.com/security/cve/CVE-2023-4911
https://access.redhat.com/errata/RHSA-2024:0033
https://access.redhat.com/errata/RHSA-2023:5476
https://access.redhat.com/errata/RHSA-2023:5455
https://securelist.com/container-security-typical-issues/119974/
https://securelist.com/exploits-and-vulnerabilities-q3-2024/114839/
https://github.com/keenglomerate/bastion_ai
https://github.com/mainfiji/layer8-security-incident-response
https://github.com/bahartanir/wp2shell-scanner
https://github.com/fsrv-xyz/ubuntu-cve-api-server
https://github.com/baeseungwon1010/CVE-2023-4911
https://github.com/Baiye-2004/cve-poc-collection
https://github.com/Abhay1921/RiskFree
https://github.com/cbrkrtek/ai-devsecops-auto-remediation
https://github.com/nextgensoumen/soc-pulse
https://github.com/nastya-chit/Cve-Automated-Triage
https://github.com/comandre-ex/cve-notifier
https://github.com/honney336/CVEs
https://github.com/halaqubeilat/NashamaCyber-Capstone-Project-Report
https://github.com/shacojx/CVE-2023-4911-Exploit
https://github.com/teraGL/looneyCVE
https://github.com/KernelKrise/Looney-Tunables-LPE-workshop-CVE-2023-4911-
https://github.com/silent6trinity/looney-tuneables
https://github.com/Ha0-Y/kernel-exploit-cve
https://github.com/Ha0-Y/LinuxKernelExploits
https://www.debian.org/security/2023/dsa-5514
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911
https://bugzilla.redhat.com/show_bug.cgi?id=2238352
http://www.openwall.com/lists/oss-security/2023/10/14/6
http://www.openwall.com/lists/oss-security/2023/10/14/5
http://www.openwall.com/lists/oss-security/2023/10/14/3
http://www.openwall.com/lists/oss-security/2023/10/13/11
Details
Published: 2023-10-03
Updated: 2026-06-17
Named Vulnerability: Looney TunablesKnown Exploited Vulnerability (KEV)
Risk Information
CVSS v2
Base Score: 6.8
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
Severity: Medium
CVSS v3
Base Score: 7.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: High
EPSS
EPSS: 0.81422