IM
IronMonkey Threat Research

CVE-2023-4911 HIGH

Published: 2023-10-03 | Last Modified: 2026-05-12 | Status: Analyzed

Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Additional Descriptions (1)

Se descubrió un desbordamiento del búfer en el cargador dinámico ld.so de la librería GNU C mientras se procesaba la variable de entorno GLIBC_TUNABLES. Este problema podría permitir que un atacante local utilice variables de entorno GLIBC_TUNABLES manipuladas con fines malintencionados al iniciar archivos binarios con permiso SUID para ejecutar código con privilegios elevados.

CVSS Metrics

Base Score: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-122
[email protected] Primary
en CWE-787

Affected Products

Vendor Product Version Update Type
netapp bootstrap_os - <built-in method update of dict object at 0x7fd3846c2bc0> Operating System
siemens simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware * <built-in method update of dict object at 0x7fd36a73bcc0> Operating System
siemens simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware * <built-in method update of dict object at 0x7fd3703f7440> Operating System
siemens siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware * <built-in method update of dict object at 0x7fd3686ed880> Operating System
siemens simatic_s7-1500_tm_mfp_firmware * <built-in method update of dict object at 0x7fd3846c0c00> Operating System
gnu glibc * <built-in method update of dict object at 0x7fd3846c0840> Application
fedoraproject fedora 37 <built-in method update of dict object at 0x7fd36b3c3480> Operating System
fedoraproject fedora 38 <built-in method update of dict object at 0x7fd341bebf00> Operating System
fedoraproject fedora 39 <built-in method update of dict object at 0x7fd36b3c2540> Operating System
redhat codeready_linux_builder 9.0 <built-in method update of dict object at 0x7fd3846c3c00> Application
redhat codeready_linux_builder_eus 8.6 <built-in method update of dict object at 0x7fd36b3c3fc0> Application
redhat codeready_linux_builder_eus 9.2 <built-in method update of dict object at 0x7fd3408d2000> Application
redhat codeready_linux_builder_eus 9.4 <built-in method update of dict object at 0x7fd36a73b3c0> Application
redhat codeready_linux_builder_eus 9.6 <built-in method update of dict object at 0x7fd3606a05c0> Application
redhat codeready_linux_builder_for_arm64 9.0_aarch64 <built-in method update of dict object at 0x7fd341e3ae80> Application
redhat codeready_linux_builder_for_arm64_eus 8.6 <built-in method update of dict object at 0x7fd36b3c0800> Application
redhat codeready_linux_builder_for_arm64_eus 9.2_aarch64 <built-in method update of dict object at 0x7fd348bbd2c0> Application
redhat codeready_linux_builder_for_arm64_eus 9.4_aarch64 <built-in method update of dict object at 0x7fd3846c1e00> Application
redhat codeready_linux_builder_for_arm64_eus 9.6_aarch64 <built-in method update of dict object at 0x7fd36b3c2300> Application
redhat codeready_linux_builder_for_ibm_z_systems 9.0_s390x <built-in method update of dict object at 0x7fd38672f280> Application
redhat codeready_linux_builder_for_ibm_z_systems_eus 8.6 <built-in method update of dict object at 0x7fd36b3c1b40> Application
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.2_s390x <built-in method update of dict object at 0x7fd36b3c2e80> Application
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.4_s390x <built-in method update of dict object at 0x7fd36a73aa00> Application
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.6_s390x <built-in method update of dict object at 0x7fd2dbefbc40> Application
redhat codeready_linux_builder_for_power_little_endian 9.0_ppc64le <built-in method update of dict object at 0x7fd36b3c3a80> Application
redhat codeready_linux_builder_for_power_little_endian_eus 8.6 <built-in method update of dict object at 0x7fd36b3c1240> Application
redhat codeready_linux_builder_for_power_little_endian_eus 9.2_ppc64le <built-in method update of dict object at 0x7fd36ae4bd00> Application
redhat codeready_linux_builder_for_power_little_endian_eus 9.4_ppc64le <built-in method update of dict object at 0x7fd36b3c3a40> Application
redhat codeready_linux_builder_for_power_little_endian_eus 9.6_ppc64le <built-in method update of dict object at 0x7fd36a6e6d40> Application
redhat virtualization 4.0 <built-in method update of dict object at 0x7fd36945f600> Application
redhat virtualization_host 4.0 <built-in method update of dict object at 0x7fd36a6e4840> Application
redhat enterprise_linux 8.0 <built-in method update of dict object at 0x7fd319e51400> Operating System
redhat enterprise_linux 9.0 <built-in method update of dict object at 0x7fd3688a5100> Operating System
redhat enterprise_linux_eus 8.6 <built-in method update of dict object at 0x7fd39c4d4880> Operating System
redhat enterprise_linux_eus 9.2 <built-in method update of dict object at 0x7fd39c4d7dc0> Operating System
redhat enterprise_linux_eus 9.4 <built-in method update of dict object at 0x7fd39c4d5c00> Operating System
redhat enterprise_linux_eus 9.6 <built-in method update of dict object at 0x7fd3688a7c00> Operating System
redhat enterprise_linux_for_arm_64 9.0_aarch64 <built-in method update of dict object at 0x7fd36b1060c0> Operating System
redhat enterprise_linux_for_arm_64_eus 8.6_aarch64 <built-in method update of dict object at 0x7fd36a717840> Operating System
redhat enterprise_linux_for_arm_64_eus 9.2_aarch64 <built-in method update of dict object at 0x7fd2dbef8900> Operating System
redhat enterprise_linux_for_arm_64_eus 9.4_aarch64 <built-in method update of dict object at 0x7fd39c47eb40> Operating System
redhat enterprise_linux_for_arm_64_eus 9.6_aarch64 <built-in method update of dict object at 0x7fd39c4d4080> Operating System
redhat enterprise_linux_for_ibm_z_systems 9.0_s390x <built-in method update of dict object at 0x7fd39c47f4c0> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 9.2_s390x <built-in method update of dict object at 0x7fd348bbee80> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 9.4_s390x <built-in method update of dict object at 0x7fd3688a4a40> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 9.6_s390x <built-in method update of dict object at 0x7fd36b1069c0> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus_s390x 8.6 <built-in method update of dict object at 0x7fd2dbcbbf80> Operating System
redhat enterprise_linux_for_power_big_endian_eus 8.6_ppc64le <built-in method update of dict object at 0x7fd3686ed000> Operating System
redhat enterprise_linux_for_power_little_endian 9.0_ppc64le <built-in method update of dict object at 0x7fd36b7d7540> Operating System
redhat enterprise_linux_for_power_little_endian_eus 9.2_ppc64le <built-in method update of dict object at 0x7fd36971e5c0> Operating System
redhat enterprise_linux_for_power_little_endian_eus 9.4_ppc64le <built-in method update of dict object at 0x7fd38518b100> Operating System
redhat enterprise_linux_for_power_little_endian_eus 9.6_ppc64le <built-in method update of dict object at 0x7fd348bbdac0> Operating System
redhat enterprise_linux_server_aus 8.6 <built-in method update of dict object at 0x7fd2dbe0d200> Operating System
redhat enterprise_linux_server_aus 9.2 <built-in method update of dict object at 0x7fd348bbec80> Operating System
redhat enterprise_linux_server_aus 9.4 <built-in method update of dict object at 0x7fd36adf4600> Operating System
redhat enterprise_linux_server_aus 9.6 <built-in method update of dict object at 0x7fd31b246580> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 9.2_ppc64le <built-in method update of dict object at 0x7fd36066bc00> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 9.4_ppc64le <built-in method update of dict object at 0x7fd3845fe200> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 9.6_ppc64le <built-in method update of dict object at 0x7fd348bbff00> Operating System
redhat enterprise_linux_server_tus 8.6 <built-in method update of dict object at 0x7fd348bbde80> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 9.2 <built-in method update of dict object at 0x7fd36041dc80> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 9.4 <built-in method update of dict object at 0x7fd3686ec680> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 9.6 <built-in method update of dict object at 0x7fd36adf7ac0> Operating System
canonical ubuntu_linux 22.04 <built-in method update of dict object at 0x7fd348bbf3c0> Operating System
canonical ubuntu_linux 23.04 <built-in method update of dict object at 0x7fd2dbcb93c0> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd36041ef80> Operating System
debian debian_linux 12.0 <built-in method update of dict object at 0x7fd36adf5600> Operating System
netapp h410c_firmware - <built-in method update of dict object at 0x7fd36971dbc0> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd36adf5a40> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd36a716540> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd3703fcf80> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd384e9ac40> Operating System
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd348bbc9c0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

References