{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2023-4911", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2023-09-12T13:10:32.495Z", "datePublished": "2023-10-03T17:25:08.434Z", "dateUpdated": "2024-09-16T13:49:25.654Z" }, "containers": { "cna": { "title": "Glibc: buffer overflow in ld.so leading to privilege escalation", "metrics": [ { "other": { "content": { "value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/" }, "type": "Red Hat severity rating" } }, { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS" } ], "descriptions": [ { "lang": "en", "value": "A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges." } ], "affected": [ { "versions": [ { "status": "affected", "version": "2.34", "lessThan": "2.39", "versionType": "custom" } ], "packageName": "glibc", "collectionURL": "https://sourceware.org/git/glibc.git", "defaultStatus": "unaffected" }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "affected", "versions": [ { "version": "0:2.28-225.el8_8.6", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos", "cpe:/a:redhat:enterprise_linux:8::crb" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "affected", "versions": [ { "version": "0:2.28-225.el8_8.6", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:enterprise_linux:8::appstream", "cpe:/o:redhat:enterprise_linux:8::baseos", "cpe:/a:redhat:enterprise_linux:8::crb" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "affected", "versions": [ { "version": "0:2.28-189.6.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:rhel_eus:8.6::appstream", "cpe:/o:redhat:rhev_hypervisor:4.4::el8", "cpe:/o:redhat:rhel_eus:8.6::baseos", "cpe:/a:redhat:rhel_eus:8.6::crb" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "affected", "versions": [ { "version": "0:2.34-60.el9_2.7", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "affected", "versions": [ { "version": "0:2.34-60.el9_2.7", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:enterprise_linux:9::crb", "cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "affected", "versions": [ { "version": "0:2.34-28.el9_0.4", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:rhel_eus:9.0::appstream", "cpe:/a:redhat:rhel_eus:9.0::crb", "cpe:/o:redhat:rhel_eus:9.0::baseos" ] }, { "vendor": "Red Hat", "product": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "affected", "versions": [ { "version": "0:2.28-189.6.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/a:redhat:rhel_eus:8.6::appstream", "cpe:/o:redhat:rhev_hypervisor:4.4::el8", "cpe:/o:redhat:rhel_eus:8.6::baseos", "cpe:/a:redhat:rhel_eus:8.6::crb" ] }, { "vendor": "Red Hat", "product": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "redhat-release-virtualization-host", "defaultStatus": "affected", "versions": [ { "version": "0:4.5.3-10.el8ev", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:rhev_hypervisor:4.4::el8" ] }, { "vendor": "Red Hat", "product": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "redhat-virtualization-host", "defaultStatus": "affected", "versions": [ { "version": "0:4.5.3-202312060823_8.6", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "cpes": [ "cpe:/o:redhat:rhev_hypervisor:4.4::el8" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "unaffected", "cpes": [ "cpe:/o:redhat:enterprise_linux:6" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "compat-glibc", "defaultStatus": "unaffected", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ] }, { "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "glibc", "defaultStatus": "unaffected", "cpes": [ "cpe:/o:redhat:enterprise_linux:7" ] } ], "references": [ { "url": "https://access.redhat.com/errata/RHSA-2023:5453", "name": "RHSA-2023:5453", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2023:5454", "name": "RHSA-2023:5454", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2023:5455", "name": "RHSA-2023:5455", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2023:5476", "name": "RHSA-2023:5476", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:0033", "name": "RHSA-2024:0033", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2023-4911", "tags": [ "vdb-entry", "x_refsource_REDHAT" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238352", "name": "RHBZ#2238352", "tags": [ "issue-tracking", "x_refsource_REDHAT" ] }, { "url": "https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt" }, { "url": "https://www.qualys.com/cve-2023-4911/" } ], "datePublic": "2023-10-03T17:00:00+00:00", "problemTypes": [ { "descriptions": [ { "cweId": "CWE-122", "description": "Heap-based Buffer Overflow", "lang": "en", "type": "CWE" } ] } ], "x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow", "workarounds": [ { "lang": "en", "value": "For customers who cannot update immediately and do not have Secure Boot feature enabled, the issue can be mitigated using the provided SystemTap script with the following steps. When enabled, any setuid program invoked with GLIBC_TUNABLES in the environment will be terminated immediately. To invoke the setuid program, users will then have to unset or clear the GLIBC_TUNABLES envvar, e.g. `GLIBC_TUNABLES= sudo` . \n\nNote that these mitigation steps will need to be repeated if the system is rebooted.\n\n1) Install required systemtap packages and dependencies as per - https://access.redhat.com/solutions/5441\n\n\n2) Create the following systemtap script, and name it stap_block_suid_tunables.stp:\n ~~~\nfunction has_tunable_string:long()\n{\n name = \"GLIBC_TUNABLES\"\n\n mm = @task(task_current())->mm;\n if (mm)\n {\n env_start = @mm(mm)->env_start;\n env_end = @mm(mm)->env_end;\n\n if (env_start != 0 && env_end != 0)\n while (env_end > env_start)\n {\n cur = user_string(env_start, \"\");\n env_name = tokenize(cur, \"=\");\n \n if (env_name == name && tokenize(\"\", \"\") != \"\")\n return 1;\n env_start += strlen (cur) + 1\n }\n }\n\n return 0;\n}\n\nprobe process(\"/lib*/ld*.so*\").function(\"__tunables_init\")\n{\n atsecure = 0;\n /* Skip processing if we can't read __libc_enable_secure, e.g. core dump\n handler (systemd-cgroups-agent and systemd-coredump). */\n try { atsecure = @var(\"__libc_enable_secure\"); }\n catch { printk (4, sprintf (\"CVE-2023-4911: Skipped check: %s (%d)\", execname(), pid())); }\n if (atsecure && has_tunable_string ())\n raise (9);\n}\n~~~\n\n3) Load the systemtap module into the running kernel:\n ~~~\n stap -g -F -m stap_block_suid_tunables stap_block_suid_tunables.stp\n ~~~\n\n4) Ensure the module is loaded:\n ~~~\n lsmod | grep -i stap_block_suid_tunables\nstap_block_suid_tunables 249856 0\n~~~\n\n5) Once the glibc package is updated to the version containing the fix, the systemtap generated kernel module can be removed by running:\n ~~~\n rmmod stap_block_suid_tunables\n ~~~\n\nIf Secure Boot is enabled on a system, the SystemTap module must be signed. An external compiling server can be used to sign the generated kernel module with a key enrolled into the kernel's keyring or starting with SystemTap 4.7 you can sign a module without a compile server. See further information here - https://www.redhat.com/sysadmin/secure-boot-systemtap" } ], "timeline": [ { "lang": "en", "time": "2023-09-04T00:00:00+00:00", "value": "Reported to Red Hat." }, { "lang": "en", "time": "2023-10-03T17:00:00+00:00", "value": "Made public." } ], "credits": [ { "lang": "en", "value": "Red Hat would like to thank Qualys Research Labs for reporting this issue." } ], "providerMetadata": { "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-09-16T13:49:25.654Z" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:44:52.050Z" }, "title": "CVE Program Container", "references": [ { "url": "http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html", "tags": [ "x_transferred" ] }, { "url": "http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html", "tags": [ "x_transferred" ] }, { "url": "http://seclists.org/fulldisclosure/2023/Oct/11", "tags": [ "x_transferred" ] }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/03/2", "tags": [ "x_transferred" ] }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/03/3", "tags": [ "x_transferred" ] }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/05/1", "tags": [ "x_transferred" ] }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/13/11", "tags": [ "x_transferred" ] }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/14/3", "tags": [ "x_transferred" ] }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/14/5", "tags": [ "x_transferred" ] }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/14/6", "tags": [ "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2023:5453", "name": "RHSA-2023:5453", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2023:5454", "name": "RHSA-2023:5454", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2023:5455", "name": "RHSA-2023:5455", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2023:5476", "name": "RHSA-2023:5476", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/errata/RHSA-2024:0033", "name": "RHSA-2024:0033", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2023-4911", "tags": [ "vdb-entry", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2238352", "name": "RHBZ#2238352", "tags": [ "issue-tracking", "x_refsource_REDHAT", "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/", "tags": [ "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/", "tags": [ "x_transferred" ] }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/", "tags": [ "x_transferred" ] }, { "url": "https://security.gentoo.org/glsa/202310-03", "tags": [ "x_transferred" ] }, { "url": "https://security.netapp.com/advisory/ntap-20231013-0006/", "tags": [ "x_transferred" ] }, { "url": "https://www.debian.org/security/2023/dsa-5514", "tags": [ "x_transferred" ] }, { "url": "https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt", "tags": [ "x_transferred" ] }, { "url": "https://www.qualys.com/cve-2023-4911/", "tags": [ "x_transferred" ] } ] } ] } }