IM
IronMonkey Threat Research

CVE-2023-4911 HIGH

Published: 2023-10-03 | Last Modified: 2026-05-12 | Status: Analyzed

Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Additional Descriptions (1)

Se descubrió un desbordamiento del búfer en el cargador dinámico ld.so de la librería GNU C mientras se procesaba la variable de entorno GLIBC_TUNABLES. Este problema podría permitir que un atacante local utilice variables de entorno GLIBC_TUNABLES manipuladas con fines malintencionados al iniciar archivos binarios con permiso SUID para ejecutar código con privilegios elevados.

CVSS Metrics

Base Score: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 5.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-122
[email protected] Primary
en CWE-787

Affected Products

Vendor Product Version Update Type
netapp bootstrap_os - <built-in method update of dict object at 0x7fd28976d140> Operating System
siemens simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware * <built-in method update of dict object at 0x7fd384dd6240> Operating System
siemens simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware * <built-in method update of dict object at 0x7fd308688b80> Operating System
siemens siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware * <built-in method update of dict object at 0x7fd31b2f7c00> Operating System
siemens simatic_s7-1500_tm_mfp_firmware * <built-in method update of dict object at 0x7fd28976e880> Operating System
gnu glibc * <built-in method update of dict object at 0x7fd384dd5840> Application
fedoraproject fedora 37 <built-in method update of dict object at 0x7fd340af0b40> Operating System
fedoraproject fedora 38 <built-in method update of dict object at 0x7fd370264100> Operating System
fedoraproject fedora 39 <built-in method update of dict object at 0x7fd3843e7f40> Operating System
redhat codeready_linux_builder 9.0 <built-in method update of dict object at 0x7fd384a9a4c0> Application
redhat codeready_linux_builder_eus 8.6 <built-in method update of dict object at 0x7fd340af0fc0> Application
redhat codeready_linux_builder_eus 9.2 <built-in method update of dict object at 0x7fd384dd7680> Application
redhat codeready_linux_builder_eus 9.4 <built-in method update of dict object at 0x7fd2d8276e80> Application
redhat codeready_linux_builder_eus 9.6 <built-in method update of dict object at 0x7fd348ef0680> Application
redhat codeready_linux_builder_for_arm64 9.0_aarch64 <built-in method update of dict object at 0x7fd39c422380> Application
redhat codeready_linux_builder_for_arm64_eus 8.6 <built-in method update of dict object at 0x7fd2dbc0a080> Application
redhat codeready_linux_builder_for_arm64_eus 9.2_aarch64 <built-in method update of dict object at 0x7fd370273e80> Application
redhat codeready_linux_builder_for_arm64_eus 9.4_aarch64 <built-in method update of dict object at 0x7fd340af2200> Application
redhat codeready_linux_builder_for_arm64_eus 9.6_aarch64 <built-in method update of dict object at 0x7fd31b2f6640> Application
redhat codeready_linux_builder_for_ibm_z_systems 9.0_s390x <built-in method update of dict object at 0x7fd340af0100> Application
redhat codeready_linux_builder_for_ibm_z_systems_eus 8.6 <built-in method update of dict object at 0x7fd2d8276700> Application
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.2_s390x <built-in method update of dict object at 0x7fd31b2f55c0> Application
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.4_s390x <built-in method update of dict object at 0x7fd39c422040> Application
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.6_s390x <built-in method update of dict object at 0x7fd340af3b80> Application
redhat codeready_linux_builder_for_power_little_endian 9.0_ppc64le <built-in method update of dict object at 0x7fd3a8ddb840> Application
redhat codeready_linux_builder_for_power_little_endian_eus 8.6 <built-in method update of dict object at 0x7fd36b57cc40> Application
redhat codeready_linux_builder_for_power_little_endian_eus 9.2_ppc64le <built-in method update of dict object at 0x7fd2d8274980> Application
redhat codeready_linux_builder_for_power_little_endian_eus 9.4_ppc64le <built-in method update of dict object at 0x7fd36b104bc0> Application
redhat codeready_linux_builder_for_power_little_endian_eus 9.6_ppc64le <built-in method update of dict object at 0x7fd384dd7e40> Application
redhat virtualization 4.0 <built-in method update of dict object at 0x7fd308688bc0> Application
redhat virtualization_host 4.0 <built-in method update of dict object at 0x7fd38499e9c0> Application
redhat enterprise_linux 8.0 <built-in method update of dict object at 0x7fd2d8276e00> Operating System
redhat enterprise_linux 9.0 <built-in method update of dict object at 0x7fd308689800> Operating System
redhat enterprise_linux_eus 8.6 <built-in method update of dict object at 0x7fd384644680> Operating System
redhat enterprise_linux_eus 9.2 <built-in method update of dict object at 0x7fd36b105040> Operating System
redhat enterprise_linux_eus 9.4 <built-in method update of dict object at 0x7fd3688b3140> Operating System
redhat enterprise_linux_eus 9.6 <built-in method update of dict object at 0x7fd368ee6700> Operating System
redhat enterprise_linux_for_arm_64 9.0_aarch64 <built-in method update of dict object at 0x7fd34118cdc0> Operating System
redhat enterprise_linux_for_arm_64_eus 8.6_aarch64 <built-in method update of dict object at 0x7fd36b8561c0> Operating System
redhat enterprise_linux_for_arm_64_eus 9.2_aarch64 <built-in method update of dict object at 0x7fd36b855f80> Operating System
redhat enterprise_linux_for_arm_64_eus 9.4_aarch64 <built-in method update of dict object at 0x7fd30868b000> Operating System
redhat enterprise_linux_for_arm_64_eus 9.6_aarch64 <built-in method update of dict object at 0x7fd341c95540> Operating System
redhat enterprise_linux_for_ibm_z_systems 9.0_s390x <built-in method update of dict object at 0x7fd36b30fc80> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 9.2_s390x <built-in method update of dict object at 0x7fd308689540> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 9.4_s390x <built-in method update of dict object at 0x7fd36b30d640> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 9.6_s390x <built-in method update of dict object at 0x7fd3702e6480> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus_s390x 8.6 <built-in method update of dict object at 0x7fd34118cf40> Operating System
redhat enterprise_linux_for_power_big_endian_eus 8.6_ppc64le <built-in method update of dict object at 0x7fd3702e5c00> Operating System
redhat enterprise_linux_for_power_little_endian 9.0_ppc64le <built-in method update of dict object at 0x7fd38499f000> Operating System
redhat enterprise_linux_for_power_little_endian_eus 9.2_ppc64le <built-in method update of dict object at 0x7fd38499e340> Operating System
redhat enterprise_linux_for_power_little_endian_eus 9.4_ppc64le <built-in method update of dict object at 0x7fd38499f180> Operating System
redhat enterprise_linux_for_power_little_endian_eus 9.6_ppc64le <built-in method update of dict object at 0x7fd36a6d7a80> Operating System
redhat enterprise_linux_server_aus 8.6 <built-in method update of dict object at 0x7fd360277300> Operating System
redhat enterprise_linux_server_aus 9.2 <built-in method update of dict object at 0x7fd340ad6000> Operating System
redhat enterprise_linux_server_aus 9.4 <built-in method update of dict object at 0x7fd308689e00> Operating System
redhat enterprise_linux_server_aus 9.6 <built-in method update of dict object at 0x7fd39c4659c0> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 9.2_ppc64le <built-in method update of dict object at 0x7fd360274480> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 9.4_ppc64le <built-in method update of dict object at 0x7fd2d11c2e40> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 9.6_ppc64le <built-in method update of dict object at 0x7fd38468b440> Operating System
redhat enterprise_linux_server_tus 8.6 <built-in method update of dict object at 0x7fd360277f40> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 9.2 <built-in method update of dict object at 0x7fd360275a40> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 9.4 <built-in method update of dict object at 0x7fd360276a80> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 9.6 <built-in method update of dict object at 0x7fd36a7a8680> Operating System
canonical ubuntu_linux 22.04 <built-in method update of dict object at 0x7fd2d82773c0> Operating System
canonical ubuntu_linux 23.04 <built-in method update of dict object at 0x7fd2d8276d80> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd2d8277000> Operating System
debian debian_linux 12.0 <built-in method update of dict object at 0x7fd2d82757c0> Operating System
netapp h410c_firmware - <built-in method update of dict object at 0x7fd3602773c0> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd2d8275d40> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd360275440> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd36b8f4d40> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd36b8f6140> Operating System
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd36b8f6900> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

References