Background exploitation KEV catalog

CVE-2023-4911

GNU C Library Buffer Overflow Vulnerability

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables…

CheckOps priority index

6.8/10 Patch within 7 days

Severity7.8

Probability6.4

Exploitation3/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 63.8% higher than 99.2% of CVEs

CVSS 3.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:

Exploited for 1,078 days 21 Nov 2023

CISA due date 12 Dec 2023 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 3 / 5

KEV catalog (CISA)21 Nov 2023
Exploited in EUVD (ENISA)21 Nov 2023
Used by ransomwareno
EPSS above 10 %63.8%
No account, over the networkno

What to do

Fix

Update to a fixed version: 2.31-13+deb11u7 2.36-9+deb12u3 2.37-12

CISA guidance: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

Affected products

Red Hat Enterprise Linux 9Red Hat Virtualization 4 for Red Hat Enterprise Linux 8Red Hat Enterprise Linux 9.0 Extended Update SupportRed Hat Enterprise Linux 8.6 Extended Update SupportRed Hat Enterprise Linux 8GNU C Library

Affected versions

patch: 0:2.34-60.el9_2.7
patch: 0:4.5.3-202312060823_8.6
patch: 0:4.5.3-10.el8ev
patch: 0:2.34-28.el9_0.4
patch: 0:2.28-189.6.el8_6
patch: 0:2.28-225.el8_8.6

Weaknesses (CWE)

CWE-122

Open source packages OSV

glibcDebian:11 · CVE-2023-4911
fixed in 2.31-13+deb11u7
glibcDebian:12 · CVE-2023-4911
fixed in 2.36-9+deb12u3
glibcDebian:13 · CVE-2023-4911
fixed in 2.37-12

Timeline

03 Oct 2023
Published
21 Nov 2023
Exploitation reported (ENISA)
21 Nov 2023
Added to the KEV catalog
12 Dec 2023
CISA remediation due date
26 Sept 2026
EPSS peak: 81.4%

References

Other exploited vulnerabilities from the same vendor

CVE-2026-24061GNU InetUtils Argument Injection Vulnerability
9.3 · Background exploitation
CVE-2014-6278GNU Bash OS Command Injection Vulnerability
8.9 · Background exploitation
CVE-2014-7169GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.3 · Background exploitation
CVE-2014-6271GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.3 · Background exploitation