cyfenced.com →

[ CVE-2023-4911 · Published 3 Oct 2023 ]

GNU C Library Buffer Overflow Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 64%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-11-21
  • EPSS: 64% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CISA: GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 12 Dec 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References