CVE-2023-4911

CVE-2023-4911 ('Looney Tunables') is a buffer overflow in the GNU C Library's dynamic loader (ld.so) that occurs while processing the GLIBC_TUNABLES environment variable. A local attacker triggers it by launching a set-user-ID (SUID) binary with a maliciously crafted GLIBC_TUNABLES value, corrupting memory in the privileged process. This allows the attacker to execute code with elevated (root) privileges on the host. Any system running an affected glibc is potentially exposed, including major Linux distributions (Fedora, Red Hat, Canonical, Debian), Red Hat CodeReady Linux Builder channels, NetApp products, and Siemens SIMATIC S7-1500 firmware, although exploitation requires local execution capability or a foothold on the machine. Exploitation is confirmed in the wild: Qualys published a working proof-of-concept, the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-21, and Kinsing threat actors have used it for cryptojacking and to breach cloud environments.

What to do: Install patched glibc updates from your distribution vendor (Fedora, Red Hat, Canonical/Ubuntu, Debian) and apply Siemens firmware updates for affected SIMATIC S7-1500 MFP devices; NetApp customers should follow NetApp's remediation guidance. Until patched, audit SUID/SGID binaries (which the attacker needs as the escalation trigger) and limit untrusted local access and shell access on multi-user or cloud-hosted Linux systems. Per the CISA KEV required action, apply vendor mitigations or discontinue use, prioritizing internet-facing hosts given active Kinsing cryptojacking and cloud-breach activity.