Live › vulnerability › CVE-2023-4911
Go to dashboardThe GNU C Library dynamic loader (ld.so) has a buffer overflow when it parses the GLIBC_TUNABLES environment variable. A local attacker can run code with elevated privileges, typically root, by setting that variable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GNU GNU C Library | vendor | – | – |
| netapp bootstrap os | vendor | – | – |
| siemens simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware | vendor | >= 3.1.5 | – |
| siemens simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware | vendor | >= 3.1.5 | – |
| siemens siplus s7-1500 cpu 1518-4 pn\/dp mfp firmware | vendor | >= 3.1.5 | – |
| siemens simatic s7-1500 tm mfp firmware | vendor | < 1.1 | 1.1 |
| gnu glibc | vendor | >= 2.34, < 2.39 | 2.39 |
| fedoraproject fedora | vendor | = 37 | – |
| fedoraproject fedora | vendor | = 38 | – |
| fedoraproject fedora | vendor | = 39 | – |
| redhat codeready linux builder | vendor | = 9.0 | – |
| redhat codeready linux builder eus | vendor | = 8.6 | – |
| redhat codeready linux builder eus | vendor | = 9.2 | – |
| redhat codeready linux builder eus | vendor | = 9.4 | – |
| redhat codeready linux builder eus | vendor | = 9.6 | – |
| redhat codeready linux builder for arm64 | vendor | = 9.0_aarch64 | – |
| redhat codeready linux builder for arm64 eus | vendor | = 8.6 | – |
| redhat codeready linux builder for arm64 eus | vendor | = 9.2_aarch64 | – |
| redhat codeready linux builder for arm64 eus | vendor | = 9.4_aarch64 | – |
| redhat codeready linux builder for arm64 eus | vendor | = 9.6_aarch64 | – |
| redhat codeready linux builder for ibm z systems | vendor | = 9.0_s390x | – |
| redhat codeready linux builder for ibm z systems eus | vendor | = 8.6 | – |
| redhat codeready linux builder for ibm z systems eus | vendor | = 9.2_s390x | – |
| redhat codeready linux builder for ibm z systems eus | vendor | = 9.4_s390x | – |
| redhat codeready linux builder for ibm z systems eus | vendor | = 9.6_s390x | – |
| redhat codeready linux builder for power little endian | vendor | = 9.0_ppc64le | – |
| redhat codeready linux builder for power little endian eus | vendor | = 8.6 | – |
| redhat codeready linux builder for power little endian eus | vendor | = 9.2_ppc64le | – |
| redhat codeready linux builder for power little endian eus | vendor | = 9.4_ppc64le | – |
| redhat codeready linux builder for power little endian eus | vendor | = 9.6_ppc64le | – |
| redhat virtualization | vendor | = 4.0 | – |
| redhat virtualization host | vendor | = 4.0 | – |
| redhat enterprise linux | vendor | = 8.0 | – |
| redhat enterprise linux | vendor | = 9.0 | – |
| redhat enterprise linux eus | vendor | = 8.6 | – |
| redhat enterprise linux eus | vendor | = 9.2 | – |
| redhat enterprise linux eus | vendor | = 9.4 | – |
| redhat enterprise linux eus | vendor | = 9.6 | – |
| redhat enterprise linux for arm 64 | vendor | = 9.0_aarch64 | – |
| redhat enterprise linux for arm 64 eus | vendor | = 8.6_aarch64 | – |
| redhat enterprise linux for arm 64 eus | vendor | = 9.2_aarch64 | – |
Run ldd --version to see the glibc version and compare it to the fixed release in your distro's advisory.
Update the glibc package from your OS vendor to the patched build for CVE-2023-4911.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2023-4911")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.