CVE-2023-4911 GNU C Library Buffer Overflow

Exploited in the wild High 7.8 Published 3 Oct 2023 Updated 14 Oct 2026

A local attacker can exploit a buffer overflow in the dynamic loader to execute code with elevated privileges via malicious environment variables.

Exploited in the wild: Since 21 Nov 2023
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-4911?

CVE-2023-4911 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 3 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2023-4911?

It affects 39 products.

Linux distribution packages (40)

`compat-libpthread-nonshared` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`glibc-benchtests-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`glibc-common-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`glibc-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`glibc-debugsource` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`glibc-gconv-extra-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`glibc-utils` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`glibc-utils-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`libnsl-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`nscd-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`nss_db-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`nss_hesiod-debuginfo` Red Hat:rhel_eus:8.6::appstream	All versions	`0:2.28-189.6.el8_6`
`glibc` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-all-langpacks` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-benchtests-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-common` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-common-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-debugsource` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-devel` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-doc` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-gconv-extra` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-gconv-extra-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-headers` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-aa` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-af` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-agr` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-ak` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-am` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-an` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-anp` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-ar` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-as` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-ast` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-ayc` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-az` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-be` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-bem` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-ber` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`
`glibc-langpack-bg` Red Hat:rhel_eus:8.6::baseos	All versions	`0:2.28-189.6.el8_6`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Gnu Glibc, Netapp Bootstrap Os, Netapp H300s Firmware and 33 more.

How do I fix CVE-2023-4911?

Apply the vendor's patch. US federal agencies must fix it by 12 Dec 2023.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-4911 being exploited?

Yes. Attackers have exploited CVE-2023-4911 in the wild since at least 21 Nov 2023.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 22 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as AZL-31117, AZL-34733, BELL-CVE-2023-4911, CLSA-2023-1698312626, DEBIAN-CVE-2023-4911, DSA-5514-1 and 12 more.