# CVE-2023-4911 (Looney Tunables)

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

- Page: https://www.vulneraibility.com/cve/CVE-2023-4911
- CVSS: 7.8
- Known exploited: yes, in CISA KEV since 2023-11-21; CISA due date 2023-12-12
- EPSS: 63.77% (percentile 99.2)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 22 GitHub proofs of concept (first 2023-10-04)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-10-15)
- Weakness: CWE-122
- Published: 2023-10-03

## Affected

- netapp:bootstrap_os
- siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware
- siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware
- siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware
- siemens:simatic_s7-1500_tm_mfp_firmware
- gnu:glibc
- fedoraproject:fedora
- redhat:codeready_linux_builder
- redhat:codeready_linux_builder_eus
- redhat:codeready_linux_builder_for_arm64
- redhat:codeready_linux_builder_for_arm64_eus
- redhat:codeready_linux_builder_for_ibm_z_systems
- redhat:codeready_linux_builder_for_ibm_z_systems_eus
- redhat:codeready_linux_builder_for_power_little_endian
- redhat:codeready_linux_builder_for_power_little_endian_eus
- redhat:virtualization
- redhat:virtualization_host
- redhat:enterprise_linux
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_for_arm_64
- redhat:enterprise_linux_for_arm_64_eus
- redhat:enterprise_linux_for_ibm_z_systems
- redhat:enterprise_linux_for_ibm_z_systems_eus
- redhat:enterprise_linux_for_ibm_z_systems_eus_s390x
- redhat:enterprise_linux_for_power_big_endian_eus
- redhat:enterprise_linux_for_power_little_endian
- redhat:enterprise_linux_for_power_little_endian_eus
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- redhat:enterprise_linux_server_tus

## References

- [advisory] https://access.redhat.com/errata/RHSA-2023:5453
- [advisory] https://access.redhat.com/errata/RHSA-2023:5454
- [advisory] https://access.redhat.com/errata/RHSA-2023:5455
- [advisory] https://access.redhat.com/errata/RHSA-2023:5476
- [advisory] https://access.redhat.com/errata/RHSA-2024:0033
- [other] https://access.redhat.com/security/cve/CVE-2023-4911
- [other] https://bugzilla.redhat.com/show_bug.cgi?id=2238352
- [other] https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
- [other] https://www.qualys.com/cve-2023-4911/
- [other] https://www.exploit-db.com/exploits/52479
- [other] http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html
- [other] http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html
- [other] http://seclists.org/fulldisclosure/2023/Oct/11
- [other] http://www.openwall.com/lists/oss-security/2023/10/03/2
- [other] http://www.openwall.com/lists/oss-security/2023/10/03/3
- [other] http://www.openwall.com/lists/oss-security/2023/10/05/1
- [other] http://www.openwall.com/lists/oss-security/2023/10/13/11
- [other] http://www.openwall.com/lists/oss-security/2023/10/14/3
- [other] http://www.openwall.com/lists/oss-security/2023/10/14/5
- [other] http://www.openwall.com/lists/oss-security/2023/10/14/6
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/
- [other] https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/
- [other] https://security.gentoo.org/glsa/202310-03
- [other] https://security.netapp.com/advisory/ntap-20231013-0006/
- [other] https://www.debian.org/security/2023/dsa-5514
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911
- [other] https://cert-portal.siemens.com/productcert/html/ssa-831302.html
- [other] https://cert-portal.siemens.com/productcert/html/ssa-794697.html
- [other] https://cert-portal.siemens.com/productcert/html/ssa-082556.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.