{"id":"CVE-2023-4911","kind":"vulnerability","aliases":["CVE-2023-4911"],"related":[],"title":"A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES…","description":"GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"The GNU C Library dynamic loader (ld.so) has a buffer overflow when it parses the GLIBC_TUNABLES environment variable. A local attacker can run code with elevated privileges, typically root, by setting that variable.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2023-11-21T00:00:00+00:00","products":[{"name":"GNU GNU C Library","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"netapp bootstrap os","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"siemens simatic s7-1500 cpu 1518-4 pn\\/dp mfp firmware","fixed":[],"affected":">= 3.1.5","ecosystem":"vendor"},{"name":"siemens simatic s7-1500 cpu 1518f-4 pn\\/dp mfp firmware","fixed":[],"affected":">= 3.1.5","ecosystem":"vendor"},{"name":"siemens siplus s7-1500 cpu 1518-4 pn\\/dp mfp firmware","fixed":[],"affected":">= 3.1.5","ecosystem":"vendor"},{"name":"siemens simatic s7-1500 tm mfp firmware","fixed":["1.1"],"affected":"< 1.1","ecosystem":"vendor"},{"name":"gnu glibc","fixed":["2.39"],"affected":">= 2.34, < 2.39","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 37","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 38","ecosystem":"vendor"},{"name":"fedoraproject fedora","fixed":[],"affected":"= 39","ecosystem":"vendor"},{"name":"redhat codeready linux builder","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"redhat codeready linux builder eus","fixed":[],"affected":"= 8.6","ecosystem":"vendor"},{"name":"redhat codeready linux builder eus","fixed":[],"affected":"= 9.2","ecosystem":"vendor"},{"name":"redhat codeready linux builder eus","fixed":[],"affected":"= 9.4","ecosystem":"vendor"},{"name":"redhat codeready linux builder eus","fixed":[],"affected":"= 9.6","ecosystem":"vendor"},{"name":"redhat codeready linux builder for arm64","fixed":[],"affected":"= 9.0_aarch64","ecosystem":"vendor"},{"name":"redhat codeready linux builder for arm64 eus","fixed":[],"affected":"= 8.6","ecosystem":"vendor"},{"name":"redhat codeready linux builder for arm64 eus","fixed":[],"affected":"= 9.2_aarch64","ecosystem":"vendor"},{"name":"redhat codeready linux builder for arm64 eus","fixed":[],"affected":"= 9.4_aarch64","ecosystem":"vendor"},{"name":"redhat codeready linux builder for arm64 eus","fixed":[],"affected":"= 9.6_aarch64","ecosystem":"vendor"},{"name":"redhat codeready linux builder for ibm z systems","fixed":[],"affected":"= 9.0_s390x","ecosystem":"vendor"},{"name":"redhat codeready linux builder for ibm z systems eus","fixed":[],"affected":"= 8.6","ecosystem":"vendor"},{"name":"redhat codeready linux builder for ibm z systems eus","fixed":[],"affected":"= 9.2_s390x","ecosystem":"vendor"},{"name":"redhat codeready linux builder for ibm z systems eus","fixed":[],"affected":"= 9.4_s390x","ecosystem":"vendor"},{"name":"redhat codeready linux builder for ibm z systems eus","fixed":[],"affected":"= 9.6_s390x","ecosystem":"vendor"},{"name":"redhat codeready linux builder for power little endian","fixed":[],"affected":"= 9.0_ppc64le","ecosystem":"vendor"},{"name":"redhat codeready linux builder for power little endian eus","fixed":[],"affected":"= 8.6","ecosystem":"vendor"},{"name":"redhat codeready linux builder for power little endian eus","fixed":[],"affected":"= 9.2_ppc64le","ecosystem":"vendor"},{"name":"redhat codeready linux builder for power little endian eus","fixed":[],"affected":"= 9.4_ppc64le","ecosystem":"vendor"},{"name":"redhat codeready linux builder for power little endian eus","fixed":[],"affected":"= 9.6_ppc64le","ecosystem":"vendor"},{"name":"redhat virtualization","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"redhat virtualization host","fixed":[],"affected":"= 4.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 8.6","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 9.2","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 9.4","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 9.6","ecosystem":"vendor"},{"name":"redhat enterprise linux for arm 64","fixed":[],"affected":"= 9.0_aarch64","ecosystem":"vendor"},{"name":"redhat enterprise linux for arm 64 eus","fixed":[],"affected":"= 8.6_aarch64","ecosystem":"vendor"},{"name":"redhat enterprise linux for arm 64 eus","fixed":[],"affected":"= 9.2_aarch64","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","glibc","infrastructure","linux","self-hosted","shared-hosts"],"not_affected_if":["managed-hosting-patched","non-vulnerable-glibc-version"],"how_to_check":"Run ldd --version to see the glibc version and compare it to the fixed release in your distro's advisory.","fix":"Update the glibc package from your OS vendor to the patched build for CVE-2023-4911.","status":"open","published_at":"2023-10-03T18:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:02:48+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:02:48Z","model":"claude-haiku-5-5","output":{"fix":"Update the glibc package from your OS vendor to the patched build for CVE-2023-4911.\nunknown","reach":"local","impact":"high","summary":"The GNU C Library dynamic loader (ld.so) has a buffer overflow when it parses the GLIBC_TUNABLES environment variable. A local attacker can run code with elevated privileges, typically root, by setting that variable.","category":"infrastructure","who_cares":["linux","glibc","self-hosted","shared-hosts"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local user gains root privileges via the loader's environment variable handling.","analyst_note":"Confirm the fixed glibc versions per distro (Ubuntu, Debian, RHEL) from vendor advisories; the sources given do not list them.","how_to_check":"Run ldd --version to see the glibc version and compare it to the fixed release in your distro's advisory.\nunknown","needs_analyst":true,"not_affected_if":["non-vulnerable-glibc-version","managed-hosting-patched"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000484,"input_tokens":2831,"output_tokens":401,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1500':36A,47A,58A,69A '-2023':21A,24A '-4':39A,50A,61A '-4911':22A,25A '/dp':41A,52A,63A '1518':38A,60A '1518f':49A '64':259A,265A,272A 'action':349C 'allow':337C 'appli':350C 'arm':258A,264A,271A 'arm64':110A,116A,123A,130A,137A 'attack':305B,340C 'bootstrap':31A 'buffer':2A,293B,327C 'builder':84A,88A,93A,98A,103A,108A,114A,121A,128A,135A,142A,150A,159A,168A,177A,186A,194A,203A,212A,221A 'c':9A,28A,286B,319C 'cisa':347C 'code':308B,343C 'codeready':82A,86A,91A,96A,101A,106A,112A,119A,126A,133A,140A,148A,157A,166A,175A,184A,192A,201A,210A,219A 'contain':325C 'cpu':37A,48A,59A 'cve':20A,23A 'discontinu':356C 'discov':5A 'dynam':12A,288B,322C 'elev':310B,345C 'endian':190A,198A,207A,216A,225A 'enterprise':233A,236A,239A,243A,247A,251A,255A,261A,268A 'environ':301B,335C 'eus':89A,94A,99A,104A,117A,124A,131A,138A,155A,164A,173A,182A,199A,208A,217A,226A,241A,245A,249A,253A,266A,273A 'execut':342C 'exploit':274B 'fedora':76A,78A,80A 'fedoraproject':75A,77A,79A 'firmware':43A,54A,65A,72A 'for':109A,115A,122A,129A,136A,143A,151A,160A,169A,178A,187A,195A,204A,213A,222A,257A,263A,270A 'glibc':18A,74A,275B,299B,333C 'gnu':8A,26A,27A,73A,285B,318C 'host':231A,280B,283B 'ibm':144A,152A,161A,170A,179A 'infrastructur':276B 'instruct':354C 'ld.so':14A,290B,324C 'librari':10A,287B,320C 'library':29A 'linux':83A,87A,92A,97A,102A,107A,113A,120A,127A,134A,141A,149A,158A,167A,176A,185A,193A,202A,211A,220A,234A,237A,240A,244A,248A,252A,256A,262A,269A,277B 'little':189A,197A,206A,215A,224A 'loader':13A,289B,323C 'local':304B,339C 'mfp':42A,53A,64A,71A 'mitig':351C,362C 'netapp':30A 'os':32A 'overflow':3A,294B,328C 'pars':297B 'per':352C 'pn':40A,51A,62A 'power':188A,196A,205A,214A,223A 'privileg':311B,346C 'process':16A,331C 'product':360C 'redhat':81A,85A,90A,95A,100A,105A,111A,118A,125A,132A,139A,147A,156A,165A,174A,183A,191A,200A,209A,218A,227A,229A,232A,235A,238A,242A,246A,250A,254A,260A,267A 'requir':348C 'root':313B 'run':307B 's7':35A,46A,57A,68A 'self':279B 'self-host':278B 'set':315B 'share':282B 'shared-host':281B 'siemens':33A,44A,55A,66A 'simatic':34A,45A,67A 'siplus':56A 'systems':146A,154A,163A,172A,181A 'tm':70A 'tunabl':19A,300B,334C 'typic':312B 'unavail':364C 'use':357C 'variabl':302B,317B,336C 'vendor':353C 'virtualization':228A,230A 'vulner':329C 'z':145A,153A,162A,171A,180A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-10-03T18:15:10+00:00","kev":{"dateAdded":"2023-11-21","dueDate":"2023-12-12","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-4911","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-4911","severity":null,"published_at":"2023-11-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-4911","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4911","severity":null,"published_at":"2023-10-03T18:15:10+00:00","modified_at":"2026-10-14T22:17:18+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}