Home / Vulnerabilities / CVE-2023-4911
HIGH SEVERITY
CVE-2023-4911 GNU · GNU C Library

GNU C Library Buffer Overflow Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH
7.8 / 10
Minimal Risk Critical
Vector Specification
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation Likelihood

EPSS Prediction

73.04 %
Predictive Probability
Percentile Rank
98.7 th

Documented as more likely to be exploited than 98.7% of known CVEs.

Detection Date

Nov 21, 2023

Remediation Due

Dec 12, 2023

CISA Catalog Active

Threat Analysis

GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

External Intelligence

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see:

https://sourceware.org/git/?p=glibc.git

h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa,

https://access.redhat.com/security/cve/cve-2023-4911,
NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2023-4911