CVE-2023-4911
| CVE Published | 2023-10-03 |
|---|---|
| Related CWE(s) | CWE-787: Out-of-bounds Write, CWE-122: Heap-based Buffer Overflow |
| Related Vendor(s) | fedoraproject, canonical, debian, gnu, redhat |
| Related Product(s) | enterprise_linux_for_power_big_endian_eus, enterprise_linux_for_ibm_z_systems_eus_s390x, enterprise_linux_server_tus, virtualization_host, codeready_linux_builder_for_arm64_eus, virtualization, glibc, ubuntu_linux, debian_linux, codeready_linux_builder_for_ibm_z_systems_eus, enterprise_linux, enterprise_linux_eus, enterprise_linux_for_arm_64_eus, codeready_linux_builder_eus, fedora, enterprise_linux_server_aus, codeready_linux_builder_for_power_little_endian_eus |
| Exploitation Reported (CISA KEV) | 2023-11-21 |
| CVSS 3 Base Score | 7.8 (HIGH) |
| CVSS 3 Attack Complexity | LOW |
| CVSS 3 Attack Vector | LOCAL |
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Cyber Threat Graph Context
Explore how this CVE relates to the wider threat graph