Secuno
ENNL
Book demo

CVE-2023-4911

GNU C Library Buffer Overflow

7.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 63.8%
  1. Published3 Oct 2023
  2. Added to CISA KEV21 Nov 2023
  3. Remediation due12 Dec 2023
Actively exploited (CISA KEV)

GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

Added to KEV: 21 Nov 2023Federal remediation due: 12 Dec 2023

Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CVSS 3.1 breakdown

Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Gnu Glibc≥ 2.34 < 2.39
Netapp Ontap Select Deploy Administration Utilityall versions
Redhat Codeready Linux Builder9.0
Redhat Codeready Linux Builder Eus8.6 · 9.2 · 9.4 · 9.6
Redhat Codeready Linux Builder For Arm649.0_aarch64
Redhat Codeready Linux Builder For Arm64 Eus8.6 · 9.2_aarch64 · 9.4_aarch64 · 9.6_aarch64
Redhat Codeready Linux Builder For Ibm Z Systems9.0_s390x
Redhat Codeready Linux Builder For Ibm Z Systems Eus8.6 · 9.2_s390x · 9.4_s390x · 9.6_s390x
Redhat Codeready Linux Builder For Power Little Endian9.0_ppc64le
Redhat Codeready Linux Builder For Power Little Endian Eus8.6 · 9.2_ppc64le · 9.4_ppc64le · 9.6_ppc64le
Redhat Virtualization4.0
Redhat Virtualization Host4.0
Canonical Ubuntu Linux22.04 · 23.04
Debian Linux11.0 · 12.0
Fedoraproject Fedora37 · 38 · 39
Netapp Bootstrap OSall versions
Netapp H300s Firmwareall versions
Netapp H410c Firmwareall versions
Netapp H410s Firmwareall versions
Netapp H500s Firmwareall versions
Netapp H700s Firmwareall versions
Redhat Enterprise Linux8.0 · 9.0
Redhat Enterprise Linux Eus8.6 · 9.2 · 9.4 · 9.6
Redhat Enterprise Linux For Arm 649.0_aarch64

Remediation

Fixed in
Gnu Glibc≥ 2.39
Siemens Simatic S7-1500 Tm Mfp Firmware≥ 1.1

References

and 20 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1078158.5
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until…
CVE-2026-195708.8
The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies…
CVE-2026-1079099.1
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the…
CVE-2026-1079089.8
A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c)…
CVE-2026-823448.1
IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow…
CVE-2026-823358.1
IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer…

Frequently asked

Is CVE-2023-4911 being actively exploited?

Yes. CVE-2023-4911 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 21 Nov 2023.

How severe is CVE-2023-4911?

CVE-2023-4911 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 63.8% probability of exploitation.

Which products are affected by CVE-2023-4911?

Affected products include Gnu Glibc, Netapp Ontap Select Deploy Administration Utility, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder Eus, Redhat Codeready Linux Builder For Arm64, and 19 more.

How do I fix CVE-2023-4911?

Upgrade affected software to a fixed version, for example Gnu Glibc 2.39, Siemens Simatic S7-1500 Tm Mfp Firmware 1.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-4911 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.