CVE-2023-4911

Published Oct 3, 2023

Last updated a month ago

Exploit knownCVSS high 7.8
Looney Tunables
Ubuntu

Overview

Description
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Source
secalert@redhat.com
NVD status
Analyzed
Products
bootstrap_os, glibc, fedora, codeready_linux_builder, codeready_linux_builder_eus, codeready_linux_builder_for_arm64, codeready_linux_builder_for_arm64_eus, codeready_linux_builder_for_ibm_z_systems, codeready_linux_builder_for_ibm_z_systems_eus, codeready_linux_builder_for_power_little_endian, codeready_linux_builder_for_power_little_endian_eus, virtualization, virtualization_host, enterprise_linux, enterprise_linux_eus, enterprise_linux_for_arm_64, enterprise_linux_for_arm_64_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_ibm_z_systems_eus, enterprise_linux_for_ibm_z_systems_eus_s390x, enterprise_linux_for_power_big_endian_eus, enterprise_linux_for_power_little_endian, enterprise_linux_for_power_little_endian_eus, enterprise_linux_server_aus, enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions, enterprise_linux_server_tus, enterprise_linux_update_services_for_sap_solutions, ubuntu_linux, debian_linux, h410c_firmware, h300s_firmware, h500s_firmware, h700s_firmware, h410s_firmware, ontap_select_deploy_administration_utility

Risk scores

CVSS 3.1

Type
Primary
Base score
7.8
Impact score
5.9
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Known exploits

Data from CISA

Vulnerability name
GNU C Library Buffer Overflow Vulnerability
Exploit added on
Nov 21, 2023
Exploit action due
Dec 12, 2023
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

secalert@redhat.com
CWE-122
nvd@nist.gov
CWE-787

Social media

Hype score
Not currently trending

  1. I just completed Looney Tunables room on TryHackMe! CVE-2023-4911: That's all Sec-Folks! https://t.co/22qmznTR2u #tryhackme via @tryhackme

    @ToTo13ru_xakep

    3 Mar 2026

    42 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE-2023-4911 PoC exploits GLIBC_TUNABLES buffer overflow in glibc 2.35–2.38 for local privilege escalation via patched libc & su. https://t.co/C8GtqcYqYv #Cybersecurity #CVE #glibc #LooneyTunables #LocalRoot #PrivilegeEscalation #ExploitPoC #LinuxSecurity #ThreatIntel #U

    @redsecuretech

    11 Feb 2026

    54 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  3. #threatreport #MediumCompleteness Snake Rustamania | 02-12-2025 Source: https://t.co/NDVMfZRJ2p Key details below ↓ 🧑‍💻Actors/Campaigns: Shedding_zmiy Overload 💀Threats: Kitsune, Octopus, Leech, Pwnkit_tool, Bulldog_backdoor, 🔓CVEs: CVE-2023-4911 https://t.co/I

    @rst_cloud

    3 Dec 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. 💣 Looney Tunables (CVE-2023-4911) es una vulnerabilidad crítica en Linux que permite escalar a root explotando una variable de entorno. Un fallo sencillo que puede tener consecuencias serias si no se actualiza glibc. 🛠️ En @FluProject te contamos cómo funciona: 🔗

    @fluproject

    26 Jul 2025

    270 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS.•CVE-2026-3888
  2. A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).•CVE-2026-4271
  3. A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection.•CVE-2026-3633
  4. A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks.•CVE-2026-3634
  5. A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.•CVE-2026-3632

References

Sources include official advisories and independent security research.