CVE-2023-4911
| CVE Published | 2023-10-03 |
|---|---|
| Related CWE(s) | CWE-122: Heap-based Buffer Overflow, CWE-787: Out-of-bounds Write |
| Related Vendor(s) | debian, redhat, gnu, fedoraproject, canonical |
| Related Product(s) | codeready_linux_builder_eus, enterprise_linux_eus, enterprise_linux_server_aus, ubuntu_linux, fedora, virtualization, enterprise_linux_for_ibm_z_systems_eus_s390x, codeready_linux_builder_for_ibm_z_systems_eus, codeready_linux_builder_for_power_little_endian_eus, glibc, enterprise_linux_server_tus, enterprise_linux_for_power_big_endian_eus, virtualization_host, debian_linux, enterprise_linux_for_arm_64_eus, codeready_linux_builder_for_arm64_eus, enterprise_linux |
| Exploitation Reported (CISA KEV) | 2023-11-21 |
| CVSS 3 Base Score | 7.8 (HIGH) |
| CVSS 3 Attack Complexity | LOW |
| CVSS 3 Attack Vector | LOCAL |
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Cyber Threat Graph Context
Explore how this CVE relates to the wider threat graph