GNU C Library Environment Variable ld.so GLIBC_TUNABLES buffer overflow

Summaryinfo

A vulnerability was found in GNU C Library and classified as critical. This affects an unknown part of the file ld.so of the component Environment Variable Handler. Executing a manipulation of the argument GLIBC_TUNABLES can lead to buffer overflow. This vulnerability is registered as CVE-2023-4911. The attack needs to be launched locally. Furthermore, an exploit is available.

Detailsinfo

A vulnerability classified as critical was found in GNU C Library (Software Library) (the affected version is unknown). This vulnerability affects an unknown code of the file ld.so of the component Environment Variable Handler. The manipulation of the argument GLIBC_TUNABLES with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

The weakness was published 10/04/2023. This vulnerability was named CVE-2023-4911 since 09/12/2023. Technical details and also a exploit are known.

It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 236691 (Alibaba Cloud Linux 3 : 0124: glibc (ALINUX3-SA-2023:0124)), which helps to determine the existence of the flaw in a target environment. This issue was added on 11/21/2023 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 12/12/2023:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (236691). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• C Library

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion