CVE-2023-4911High· 7.8▾ Abyssal⚠ Exploited in the wildPoC availableA buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variable…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 42.9 · likelihood 12.8 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Dec 12, 2023
Last analysed / modified upstream
64%
Exploit-DB · 22 GitHub repos · Metasploit ×1 (last check)
Added to the CISA catalog on Nov 21, 2023. Federal remediation due Dec 12, 2023. View catalog ↗
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
bootstrap_ossimatic_s7-1500_cpu_1518-4_pn/dp_mfp_firmware >= 3.1.5simatic_s7-1500_cpu_1518f-4_pn/dp_mfp_firmware >= 3.1.5siplus_s7-1500_cpu_1518-4_pn/dp_mfp_firmware >= 3.1.5simatic_s7-1500_tm_mfp_firmware < 1.1glibc >= 2.34, < 2.39fedora = 37fedora = 38fedora = 39codeready_linux_builder = 9.0codeready_linux_builder_eus = 8.6codeready_linux_builder_eus = 9.2codeready_linux_builder_eus = 9.4codeready_linux_builder_eus = 9.6codeready_linux_builder_for_arm64 = 9.0_aarch64codeready_linux_builder_for_arm64_eus = 8.6codeready_linux_builder_for_arm64_eus = 9.2_aarch64codeready_linux_builder_for_arm64_eus = 9.4_aarch64codeready_linux_builder_for_arm64_eus = 9.6_aarch64codeready_linux_builder_for_ibm_z_systems = 9.0_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 8.6codeready_linux_builder_for_ibm_z_systems_eus = 9.2_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 9.4_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 9.6_s390xcodeready_linux_builder_for_power_little_endian = 9.0_ppc64lecodeready_linux_builder_for_power_little_endian_eus = 8.6codeready_linux_builder_for_power_little_endian_eus = 9.2_ppc64lecodeready_linux_builder_for_power_little_endian_eus = 9.4_ppc64lecodeready_linux_builder_for_power_little_endian_eus = 9.6_ppc64levirtualization = 4.0virtualization_host = 4.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux_eus = 8.6enterprise_linux_eus = 9.2enterprise_linux_eus = 9.4enterprise_linux_eus = 9.6enterprise_linux_for_arm_64 = 9.0_aarch64enterprise_linux_for_arm_64_eus = 8.6_aarch64enterprise_linux_for_arm_64_eus = 9.2_aarch64enterprise_linux_for_arm_64_eus = 9.4_aarch64enterprise_linux_for_arm_64_eus = 9.6_aarch64enterprise_linux_for_ibm_z_systems = 9.0_s390xenterprise_linux_for_ibm_z_systems_eus = 9.2_s390xenterprise_linux_for_ibm_z_systems_eus = 9.4_s390xenterprise_linux_for_ibm_z_systems_eus = 9.6_s390xenterprise_linux_for_ibm_z_systems_eus_s390x = 8.6enterprise_linux_for_power_big_endian_eus = 8.6_ppc64leenterprise_linux_for_power_little_endian = 9.0_ppc64leenterprise_linux_for_power_little_endian_eus = 9.2_ppc64leenterprise_linux_for_power_little_endian_eus = 9.4_ppc64leenterprise_linux_for_power_little_endian_eus = 9.6_ppc64leenterprise_linux_server_aus = 8.6enterprise_linux_server_aus = 9.2enterprise_linux_server_aus = 9.4enterprise_linux_server_aus = 9.6enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.2_ppc64leenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.4_ppc64leenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions = 9.6_ppc64leenterprise_linux_server_tus = 8.6enterprise_linux_update_services_for_sap_solutions = 9.2enterprise_linux_update_services_for_sap_solutions = 9.4enterprise_linux_update_services_for_sap_solutions = 9.6ubuntu_linux = 22.04ubuntu_linux = 23.04debian_linux = 11.0debian_linux = 12.0h410c_firmwareh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwareontap_select_deploy_administration_utilityUpgrade past the affected range:
simatic_s7-1500_tm_mfp_firmware 1.1glibc 2.39Connected by shared product, vendor, weakness, or advisory.
CVE-2023-4813Medium· 5.9A flaw has been identified in glibc
CVE-2023-4806Medium· 5.9A flaw has been identified in glibc
CVE-2024-0684Medium· 5.5A flaw was found in the GNU coreutils "split" program
CVE-2023-4527Medium· 6.5Glibc: stack read overflow in getaddrinfo in no-aaaa mode
CVE-2020-10029Medium· 5.5The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 …
CVE-2026-19499High· 7.7Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path tha…