Back to CVE records
High 7.8Known exploited (CISA KEV)Published Oct 3, 2023
CVE-2023-4911Glibc: buffer overflow in ld.so leading to privilege escalation
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Enterprise Linux 8 and 44 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Nov 21, 2023; federal agencies had to remediate by Dec 12, 2023. Treat that date as your deadline.
Do this next
Start free and add your stack
Free account, 1 product
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-122
- Known exploited
- Added to CISA KEV Nov 21, 2023; federal remediation due Dec 12, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- EPSS (exploitation in the next 30 days)
- 63.77% (percentile 99)
- Assigned by
- redhat
- NVD analysis
- Analyzed
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux | from 0:2.28-225.el8_8.6 not affected | CNA record |
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support redhat:rhel_eus | from 0:2.28-189.6.el8_6 not affected | CNA record |
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support redhat:rhev_hypervisor | from 0:2.28-189.6.el8_6 not affected | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
netapp bootstrap_os netapp:bootstrap_os | all versions | NVD |
siemens simatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware siemens:simatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware | from 3.1.5 | NVD |
siemens simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware siemens:simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware | from 3.1.5 | NVD |
siemens siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware siemens:siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware | from 3.1.5 | NVD |
siemens simatic_s7-1500_tm_mfp_firmware siemens:simatic_s7-1500_tm_mfp_firmware | before 1.1 | NVD |
gnu glibc gnu:glibc | from 2.34 before 2.39 | NVD |
fedoraproject fedora fedoraproject:fedora | 37; 38; 39 | NVD |
redhat codeready_linux_builder redhat:codeready_linux_builder | 9.0 | NVD |
redhat codeready_linux_builder_eus redhat:codeready_linux_builder_eus | 8.6; 9.2; 9.4; 9.6 | NVD |
redhat codeready_linux_builder_for_arm64 redhat:codeready_linux_builder_for_arm64 | 9.0_aarch64 | NVD |
redhat codeready_linux_builder_for_arm64_eus redhat:codeready_linux_builder_for_arm64_eus | 8.6; 9.2_aarch64; 9.4_aarch64; 9.6_aarch64 | NVD |
redhat codeready_linux_builder_for_ibm_z_systems redhat:codeready_linux_builder_for_ibm_z_systems | 9.0_s390x | NVD |
redhat codeready_linux_builder_for_ibm_z_systems_eus redhat:codeready_linux_builder_for_ibm_z_systems_eus | 8.6; 9.2_s390x; 9.4_s390x; 9.6_s390x | NVD |
redhat codeready_linux_builder_for_power_little_endian redhat:codeready_linux_builder_for_power_little_endian | 9.0_ppc64le | NVD |
redhat codeready_linux_builder_for_power_little_endian_eus redhat:codeready_linux_builder_for_power_little_endian_eus | 8.6; 9.2_ppc64le; 9.4_ppc64le; 9.6_ppc64le | NVD |
redhat virtualization redhat:virtualization | 4.0 | NVD |
redhat virtualization_host redhat:virtualization_host | 4.0 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 8.0; 9.0 | NVD |
redhat enterprise_linux_eus redhat:enterprise_linux_eus | 8.6; 9.2; 9.4; 9.6 | NVD |
redhat enterprise_linux_for_arm_64 redhat:enterprise_linux_for_arm_64 | 9.0_aarch64 | NVD |
redhat enterprise_linux_for_arm_64_eus redhat:enterprise_linux_for_arm_64_eus | 8.6_aarch64; 9.2_aarch64; 9.4_aarch64; 9.6_aarch64 | NVD |
redhat enterprise_linux_for_ibm_z_systems redhat:enterprise_linux_for_ibm_z_systems | 9.0_s390x | NVD |
redhat enterprise_linux_for_ibm_z_systems_eus redhat:enterprise_linux_for_ibm_z_systems_eus | 9.2_s390x; 9.4_s390x; 9.6_s390x | NVD |
redhat enterprise_linux_for_ibm_z_systems_eus_s390x redhat:enterprise_linux_for_ibm_z_systems_eus_s390x | 8.6 | NVD |
redhat enterprise_linux_for_power_big_endian_eus redhat:enterprise_linux_for_power_big_endian_eus | 8.6_ppc64le | NVD |
redhat enterprise_linux_for_power_little_endian redhat:enterprise_linux_for_power_little_endian | 9.0_ppc64le | NVD |
redhat enterprise_linux_for_power_little_endian_eus redhat:enterprise_linux_for_power_little_endian_eus | 9.2_ppc64le; 9.4_ppc64le; 9.6_ppc64le | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 8.6; 9.2; 9.4; 9.6 | NVD |
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 9.2_ppc64le; 9.4_ppc64le; 9.6_ppc64le | NVD |
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus | 8.6 | NVD |
redhat enterprise_linux_update_services_for_sap_solutions redhat:enterprise_linux_update_services_for_sap_solutions | 9.2; 9.4; 9.6 | NVD |
canonical ubuntu_linux canonical:ubuntu_linux | 22.04; 23.04 | NVD |
debian debian_linux debian:debian_linux | 11.0; 12.0 | NVD |
netapp h410c_firmware netapp:h410c_firmware | all versions | NVD |
netapp h300s_firmware netapp:h300s_firmware | all versions | NVD |
netapp h500s_firmware netapp:h500s_firmware | all versions | NVD |
netapp h700s_firmware netapp:h700s_firmware | all versions | NVD |
netapp h410s_firmware netapp:h410s_firmware | all versions | NVD |
netapp ontap_select_deploy_administration_utility netapp:ontap_select_deploy_administration_utility | all versions | NVD |
References
- https://access.redhat.com/errata/RHSA-2023:5453vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2023:5454vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2023:5455vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2023:5476vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/errata/RHSA-2024:0033vendor-advisory, x-refsource-redhat, third-party-advisory
- https://access.redhat.com/security/cve/CVE-2023-4911vdb-entry, x-refsource-redhat, third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352issue-tracking, x-refsource-redhat, patch
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txtexploit, third-party-advisory
- https://www.qualys.com/cve-2023-4911/third-party-advisory
- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.htmlexploit, third-party-advisory, vdb-entry
- http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.htmlexploit, third-party-advisory, vdb-entry
- http://seclists.org/fulldisclosure/2023/Oct/11exploit, mailing-list, third-party-advisory
- http://www.openwall.com/lists/oss-security/2023/10/03/2exploit, mailing-list
- http://www.openwall.com/lists/oss-security/2023/10/03/3mailing-list
- http://www.openwall.com/lists/oss-security/2023/10/05/1mailing-list
- http://www.openwall.com/lists/oss-security/2023/10/13/11mailing-list
- http://www.openwall.com/lists/oss-security/2023/10/14/3mailing-list
- http://www.openwall.com/lists/oss-security/2023/10/14/5mailing-list
- http://www.openwall.com/lists/oss-security/2023/10/14/6mailing-list
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/mailing-list
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/mailing-list
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/mailing-list
- https://security.gentoo.org/glsa/202310-03third-party-advisory
- https://security.netapp.com/advisory/ntap-20231013-0006/third-party-advisory
- https://www.debian.org/security/2023/dsa-5514mailing-list
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.