NetSight
IP …
high7.8Known exploitedPublic exploit code

CVE-2023-4911

GNU C Library Buffer Overflow Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-11-21. Federal due date: 2023-12-12.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Affected products

VendorProductAffected versions
NetappBootstrap Os
All versions
SiemensSimatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware
from 3.1.5
SiemensSimatic S7-1500 Cpu 1518f-4 Pn\/Dp Mfp Firmware
from 3.1.5
SiemensSiplus S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware
from 3.1.5
SiemensSimatic S7-1500 Tm Mfp Firmware
before 1.1
GnuGlibc
from 2.34 before 2.39
FedoraprojectFedora
Versions 37, 38, 39
RedhatCodeready Linux Builder
Version 9.0
RedhatCodeready Linux Builder Eus
Versions 8.6, 9.2, 9.4, 9.6
RedhatCodeready Linux Builder For Arm64
Version 9.0_aarch64
RedhatCodeready Linux Builder For Arm64 Eus
Versions 8.6, 9.2_aarch64, 9.4_aarch64, 9.6_aarch64
RedhatCodeready Linux Builder For Ibm Z Systems
Version 9.0_s390x

Weakness classification

CWE-122CWE-787

References