« List of all CVEs

CVE-2023-4911

Glibc: buffer overflow in ld.so leading to privilege escalation

Published: 10/3/2023 Last updated: 7/14/2026 Reserved: 9/12/2023

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CNA assigner: redhat (53f830b8-0a3f-465b-8143-3b8a9948e749) Requested by: n/a

Metrics

Version Score Severity Vector String
3.1 7.8 High CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Opam packages affected (1)

gettext-stub

Products affected (21)

Product Vendor Version
Red Hat Enterprise Linux 7 Red Hat 10 Version 1809 for ARM64-based Systems
Red Hat Enterprise Linux 7 Red Hat < 2021
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Red Hat 10 Version 1803 for x64-based Systems
Red Hat Enterprise Linux 6 Red Hat 10 Version 1809 for x64-based Systems
Red Hat Enterprise Linux 7 Red Hat < 8.1
Red Hat Enterprise Linux 9.0 Extended Update Support Red Hat 10 Version 1803 for 32-bit Systems
Red Hat Enterprise Linux 9.0 Extended Update Support Red Hat < 68.9.0
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Red Hat < 77
Red Hat Enterprise Linux 6 Red Hat < 12.0
Red Hat Enterprise Linux 9 Red Hat <= New version
Red Hat Enterprise Linux 7 Red Hat 10 Version 1709 for 32-bit Systems
8.0.22 and prior
Red Hat Enterprise Linux 8 Red Hat n/a
Red Hat Enterprise Linux 8 Red Hat n/a
Red Hat Enterprise Linux 8.6 Extended Update Support Red Hat n/a
Red Hat Enterprise Linux 9 Red Hat Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a)
Red Hat Enterprise Linux 9 Red Hat n/a
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Red Hat < 68.9
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Red Hat 10 Version 1803 for ARM64-based Systems
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Red Hat 10 Version 1809 for 32-bit Systems
Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Red Hat < 15.1

References (78)

Credits (2)