VULNERABILITY INTELLIGENCE

CVE-2023-4911

CVSS score7.8 HIGH
EPSS probability63.77%
CISA KEVKnown exploited vulnerability
Published2023-10-03
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

GNU C Library Buffer Overflow Vulnerability

Vendor / product: GNU / GNU C Library

Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Weakness classification

  • secalert@redhat.com: CWE-122
  • nvd@nist.gov: CWE-787

Primary references