CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-11-21. EPSS: 63.8% chance of exploitation in the next 30 days.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Affected products

  • Canonical Ubuntu Linux: version 22.04 only; version 23.04 only
  • Debian Debian Linux: version 11.0 only; version 12.0 only
  • Fedoraproject Fedora: version 37 only; version 38 only; version 39 only
  • GNU Glibc: from 2.34, before 2.39 (fixed in 2.39)
  • Netapp Bootstrap OS: affected versions not specified
  • Netapp h300s Firmware: affected versions not specified
  • Netapp h410c Firmware: affected versions not specified
  • Netapp h410s Firmware: affected versions not specified
  • Netapp h500s Firmware: affected versions not specified
  • Netapp h700s Firmware: affected versions not specified
  • Netapp Ontap Select Deploy Administration Utility: affected versions not specified
  • Red Hat Codeready Linux Builder: version 9.0 only
  • Red Hat Codeready Linux Builder Eus: version 8.6 only; version 9.2 only; version 9.4 only; version 9.6 only
  • Red Hat Codeready Linux Builder For ARM64: version 9.0_aarch64 only
  • Red Hat Codeready Linux Builder For ARM64 Eus: version 8.6 only; version 9.2_aarch64 only; version 9.4_aarch64 only; version 9.6_aarch64 only
  • Red Hat Codeready Linux Builder For IBM Z Systems: version 9.0_s390x only
  • Red Hat Codeready Linux Builder For IBM Z Systems Eus: version 8.6 only; version 9.2_s390x only; version 9.4_s390x only; version 9.6_s390x only
  • Red Hat Codeready Linux Builder For Power Little Endian: version 9.0_ppc64le only
  • Red Hat Codeready Linux Builder For Power Little Endian Eus: version 8.6 only; version 9.2_ppc64le only; version 9.4_ppc64le only; version 9.6_ppc64le only
  • Red Hat Enterprise Linux: version 8.0 only; version 9.0 only
  • Red Hat Enterprise Linux Eus: version 8.6 only; version 9.2 only; version 9.4 only; version 9.6 only
  • Red Hat Enterprise Linux For Arm 64: version 9.0_aarch64 only
  • Red Hat Enterprise Linux For Arm 64 Eus: version 8.6_aarch64 only; version 9.2_aarch64 only; version 9.4_aarch64 only; version 9.6_aarch64 only
  • Red Hat Enterprise Linux For IBM Z Systems: version 9.0_s390x only
  • Red Hat Enterprise Linux For IBM Z Systems Eus: version 9.2_s390x only; version 9.4_s390x only; version 9.6_s390x only
  • and 14 more

Published 2023-10-03. Last modified 2026-06-17.