CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability

glibc could allow a local authenticated attacker to gain elevated privileges on the system, caused by a buffer overflow in the dynamic loader's processing of the GLIBCTUNABLES environment variable. By sending overly long data, an attacker could exploit this vulnerability to gain root privileges on the system.

— IBM

Glibc: buffer overflow in ld.so leading to privilege escalation

— Microsoft

GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBCTUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

— CISA

Researchers discovered a vulnerability in the GNU C Library's dynamic loader (ld.so). This vulnerability was introduced in April 2021 (glibc 2.34) by the following commit: https://sourceware.org/git?p=glibc.git;a=commit;h=2ed18c5b534d9e92fc006202a5af0df6b72e7aca

Per researchers this vulnerability is exploitable by any local user and can lead to privilege escalation when combined with almost any SUID-root binaries.

— Red Hat