Glibc: buffer overflow in ld.so leading to privilege escalation
Priority CRITICAL 93Exploited in the wildCWE-122Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.
Summary
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Why it matters now
Exploitation Active In CISA KEV since 2023-11-21CISA due date 2023-12-12
EPSS 0.63769 99th percentileScored 2026-11-07
Public exploit Yes 6 exploit referencesTagged by NVD
Fix Fixed glibc: 2.39Red Hat: 5 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | glibc | 2.34 to before 2.39 | 2.39 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 2.28-225.el8_8.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 2.28-225.el8_8.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | 2.28-189.6.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.34-60.el9_2.7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 2.34-60.el9_2.7 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | 2.34-28.el9_0.4 | Patch available | CNA |
| Red Hat | Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | — | 2.28-189.6.el8_6 | Patch available | CNA |
| Red Hat | Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | — | 4.5.3-10.el8ev | Patch available | CNA |
| Red Hat | Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 | — | 4.5.3-202312060823_8.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
- glibc Vendor— Affected 2.34 to before 2.39 Fixed in 2.39 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.28-225.el8_8.6 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.28-225.el8_8.6 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 2.28-189.6.el8_6 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.34-60.el9_2.7 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 2.34-60.el9_2.7 Patch available CNA
- Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 2.34-28.el9_0.4 Patch available CNA
- Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 2.28-189.6.el8_6 Patch available CNA
- Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 4.5.3-10.el8ev Patch available CNA
- Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 4.5.3-202312060823_8.6 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE configurations NVD · 83
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:* | 3.1.5 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:* | 3.1.5 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:* | 3.1.5 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:*:*:*:*:*:*:*:* | before 1.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:*:*:*:*:*:*:*:* Versions before 1.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 73 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* | 2.34 to before 2.39 | Vulnerable | GNU |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:* | 9.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:* | 9.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* | 9.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:* | 9.2_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:* | 9.4_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:* | 9.6_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* | 9.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* | 9.2_s390x | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* | 9.4_s390x | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:* | 9.6_s390x | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* | 9.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* | 9.2_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* | 9.4_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:* | 9.6_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* | 9.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* | 9.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* | 9.0_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:* | 8.6_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:* | 9.2_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:* | 9.4_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:* | 9.6_aarch64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* | 9.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* | 9.2_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* | 9.4_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:* | 9.6_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:8.6_ppc64le:*:*:*:*:*:*:* | 8.6_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* | 9.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* | 9.2_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* | 9.4_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:* | 9.6_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:* | 9.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:* | 9.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:* | 9.2_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:* | 9.4_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:* | 9.6_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* | 8.6 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:* | 9.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:* | 9.6 | Vulnerable | Red Hat |
| cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* | 22.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:* | 23.04 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* Versions 2.34 to before 2.39 Vulnerable ·GNU
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:* Versions 9.2_aarch64 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:* Versions 9.4_aarch64 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:* Versions 9.6_aarch64 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* Versions 9.0_s390x Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* Versions 9.2_s390x Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* Versions 9.4_s390x Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:* Versions 9.6_s390x Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* Versions 9.4_ppc64le Vulnerable ·Red Hat
- cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:* Versions 9.6_ppc64le Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:* Versions 9.0_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:* Versions 8.6_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:* Versions 9.2_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:* Versions 9.4_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:* Versions 9.6_aarch64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:* Versions 9.0_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* Versions 9.2_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:* Versions 9.4_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:* Versions 9.6_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:8.6_ppc64le:*:*:*:*:*:*:* Versions 8.6_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:* Versions 9.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:* Versions 9.4_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:* Versions 9.6_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:* Versions 9.2_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:* Versions 9.4_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:* Versions 9.6_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* Versions 8.6 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·Red Hat
- cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:* Versions 23.04 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA glibc Fixed in 2.39
Red Hat 5 advisories
- RHSA-2024:0033 Released 2024-01-03 · Red Hat rating ModerateRed Hat Virtualization Host 4.4.z SP 1 security update
- RHEL 8-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host-4.5.3-10.el8ev, redhat-release-virtualization-host-content-4.5.3-10.el8ev, redhat-virtualization-host-image-update-placeholder-4.5.3-10.el8ev
- Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.5.3-202312060823_8.6, redhat-virtualization-host-image-update-4.5.3-202312060823_8.6
- RHSA-2023:5476 Released 2023-10-05 · Red Hat rating Importantglibc security update
- Red Hat CodeReady Linux Builder EUS (v.8.6) glibc-benchtests-2.28-189.6.el8_6, glibc-nss-devel-2.28-189.6.el8_6, glibc-static-2.28-189.6.el8_6 +1
- Red Hat Enterprise Linux AppStream EUS (v.8.6) compat-libpthread-nonshared-2.28-189.6.el8_6, glibc-utils-2.28-189.6.el8_6
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) glibc-2.28-189.6.el8_6, glibc-all-langpacks-2.28-189.6.el8_6, glibc-common-2.28-189.6.el8_6 +47
- Red Hat Virtualization 4 Hypervisor for RHEL 8 glibc-devel-2.28-189.6.el8_6, glibc-headers-2.28-189.6.el8_6
- RHSA-2023:5455 Released 2023-10-05 · Red Hat rating Importantglibc security update
- Red Hat Enterprise Linux AppStream (v. 8) compat-libpthread-nonshared-2.28-225.el8_8.6, glibc-utils-2.28-225.el8_8.6
- Red Hat Enterprise Linux BaseOS (v. 8) glibc-2.28-225.el8_8.6, glibc-all-langpacks-2.28-225.el8_8.6, glibc-common-2.28-225.el8_8.6 +47
- Red Hat Enterprise Linux CRB (v. 8) glibc-benchtests-2.28-225.el8_8.6, glibc-nss-devel-2.28-225.el8_8.6, glibc-static-2.28-225.el8_8.6 +1
Show 2 more Red Hat advisories
- RHSA-2023:5453 Released 2023-10-05 · Red Hat rating Importantglibc security update
- Red Hat Enterprise Linux AppStream (v. 9) glibc-devel-2.34-60.el9_2.7, glibc-doc-2.34-60.el9_2.7, glibc-headers-2.34-60.el9_2.7 +2
- Red Hat Enterprise Linux BaseOS (v. 9) glibc-2.34-60.el9_2.7, glibc-all-langpacks-2.34-60.el9_2.7, glibc-common-2.34-60.el9_2.7 +47
- Red Hat Enterprise Linux CRB (v. 9) glibc-benchtests-2.34-60.el9_2.7, glibc-nss-devel-2.34-60.el9_2.7, glibc-static-2.34-60.el9_2.7 +2
- RHSA-2023:5454 Released 2023-10-05 · Red Hat rating Importantglibc security update
- Red Hat CodeReady Linux Builder EUS (v.9.0) glibc-benchtests-2.34-28.el9_0.4, glibc-nss-devel-2.34-28.el9_0.4, glibc-static-2.34-28.el9_0.4 +2
- Red Hat Enterprise Linux AppStream EUS (v.9.0) glibc-devel-2.34-28.el9_0.4, glibc-doc-2.34-28.el9_0.4, glibc-headers-2.34-28.el9_0.4 +2
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) glibc-2.34-28.el9_0.4, glibc-all-langpacks-2.34-28.el9_0.4, glibc-common-2.34-28.el9_0.4 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHEL 8-based RHEV-H for RHEV 4 (build requirements) | Fixed | RHSA-2024:0033 |
| Red Hat CodeReady Linux Builder EUS (v.8.6) | Fixed | RHSA-2023:5476 |
| Red Hat CodeReady Linux Builder EUS (v.9.0) | Fixed | RHSA-2023:5454 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:5455 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:5453 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:5476 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:5454 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:5455 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:5453 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2023:5476 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.0) | Fixed | RHSA-2023:5454 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2023:5455 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2023:5453 |
| Red Hat Virtualization 4 Hypervisor for RHEL 8 | Fixed | RHSA-2023:5476, RHSA-2024:0033 |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2023-11-21 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2023-4911
- 2026-10-03 Alias added: GHSA-m77w-6vjw-wh2f
References
Exploit 6
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
- http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2023/Oct/11
- http://www.openwall.com/lists/oss-security/2023/10/03/2
- https://www.exploit-db.com/exploits/52479
Patch 1
Advisory 12
- RHSA-2023:5453
- RHSA-2023:5454
- RHSA-2023:5455
- RHSA-2023:5476
- RHSA-2024:0033
- https://access.redhat.com/security/cve/CVE-2023-4911
- https://www.qualys.com/cve-2023-4911/
- https://security.gentoo.org/glsa/202310-03
- https://security.netapp.com/advisory/ntap-20231013-0006/
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html
More Red Hat Codeready Linux Builder vulnerabilities
- TI-2019-06284 Memory corruption in webkitgtk KEVCVSS 3.1HIGH 8.8
- TI-2022-00753 A flaw was found in the way the "flags" member of the new pipe buffer structure was… KEVCVSS 3.1HIGH 7.8
- TI-2022-00413 Improper authentication in kernel KEVCVSS 3.1HIGH 7.8
- TI-2021-19843 Out-of-bounds read in Samba CVSS 3.1HIGH 8.8
- TI-2022-00359 Out-of-bounds write in kernel CVSS 3.1HIGH 8.8
- TI-2023-28739 Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service CVSS 3.1HIGH 7.5
Sources
- CVE-2023-4911 · CVE Program
- CVE-2023-4911 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-m77w-6vjw-wh2f · GitHub Advisory Database · CC BY 4.0
- CVE-2023-4911 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences