ClosedHighPatched

Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)

GNU C Library (glibc) ld.so

A buffer overflow in glibc's dynamic loader, triggered through the GLIBC_TUNABLES environment variable, gave local users root through SUID binaries on default installs of Fedora, Ubuntu and Debian. Cloud attackers such as Kinsing were soon using it.

Why this severity: CVSS 7.8 (NVD), actively exploited (CISA KEV)

Started: Oct 3, 2023
Closed: Nov 21, 2023
CVE: CVE-2023-4911

Updated Nov 21, 2023

Affected

glibc 2.34 and later before distro fixes (per Qualys)

Fixed in

See your distribution's advisory

Timeline2

Nov 21, 2023
CISA adds CVE-2023-4911 to the KEV catalog
Oct 3, 2023
Qualys discloses Looney Tunables; distros ship patched glibc
Source

Advisories3

News & write-ups1

CVE-2023-4911: Looney Tunables – Local Privilege Escalation in the glibc's ld.soQualys · Oct 3, 2023 · Write-up

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified