Looney Tunables: CVE-2023-4911 in glibc

A buffer overflow in the dynamic loader of glibc that turns a local account into root.

Published in the NVD on 03/10/2023

CVE-2023-4911

CVSS 3.1: 7.8 (high) actively exploited

In the CISA catalogue of actively exploited vulnerabilities since 21/11/2023

Exploitation probability (EPSS, 01/11/2026): 63.769 %, percentile 99.221

What is Looney Tunables?

Looney Tunables is a buffer overflow in ld.so, the dynamic loader of the GNU C Library, while it processes the GLIBC_TUNABLES environment variable. A local attacker can start programs with SUID permission using a crafted GLIBC_TUNABLES value and execute code with elevated privileges.

The NVD rates it at CVSS 7.8, and CISA has listed it as actively exploited since 21 November 2023. The NVD lists glibc 2.34 to 2.38.

Affected and fixed versions

GNU C Library (glibc)

Affected: 2.34 - 2.38

Fixed in 2.39

Status in Debian and Ubuntu

Debian 12: glibc

Fixed

Fixed from package version 2.36-9+deb12u3

Debian 13: glibc

Fixed

Fixed from package version 2.37-12

Ubuntu 22.04 LTS: glibc

Fixed

Fixed from package version 2.35-0ubuntu3.4

Ubuntu 24.04 LTS: glibc

Fixed

Fixed from package version 2.38-1ubuntu6

What to do

Install the glibc update of your distribution, on Debian 12 version 2.36-9+deb12u3 or later, and restart the services or the system afterwards so that no process keeps using the old library.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch glibc (Debian 12)

Watch glibc (Ubuntu 22.04 LTS)

Already have an account? Log in and add glibc (Debian 12)