"Looney Tunables" bug allows root access on Linux distros (CVE-2023-4911)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-4911 | Buffer Overflow in GNU C Library ld.so Grants Root via SUID Binaries CVE-2023-4911 ('Looney Tunables') is a buffer overflow in the GNU C Library's dynamic loader (ld.so) that occurs while processing the GLIBC_TUNABLES environment variable. A local attacker triggers it by launching a set-user-ID (SUID) binary with a maliciously crafted GLIBC_TUNABLES value, corrupting memory in the privileged process. This allows the attacker to execute code with elevated (root) privileges on the host. Any system running an affected glibc is potentially exposed, including major Linux distributions (Fedora, Red Hat, Canonical, Debian), Red Hat CodeReady Linux Builder channels, NetApp products, and Siemens SIMATIC S7-1500 firmware, although exploitation requires local execution capability or a foothold on the machine. Exploitation is confirmed in the wild: Qualys published a working proof-of-concept, the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-21, and Kinsing threat actors have used it for cryptojacking and to breach cloud environments. Do: Install patched glibc updates from your distribution vendor (Fedora, Red Hat, Canonical/Ubuntu, Debian) and apply Siemens firmware updates for affected SIMATIC S7-1500 MFP devices; NetApp customers should follow NetApp's remediation guidance. Until patched, audit SUID/SGID binaries (which the attacker needs as the escalation trigger) and limit untrusted local access and shell access on multi-user or cloud-hosted Linux systems. Per the CISA KEV required action, apply vendor mitigations or discontinue use, prioritizing internet-facing hosts given active Kinsing cryptojacking and cloud-breach activity. | 7.8 | 81% | KEV PoC ×6 |
| masshundreds of millions of Linux installations worldwide (glibc is the standard C library shipped with virtually every major distribution) |
Full article354 words · extracted from helpnetsecurity.com · click to collapse
A vulnerability (CVE-2023-4911) in the GNU C Library (aka “glibc”) can be exploited by attackers to gain root privileges on many popular Linux distributions, according to Qualys researchers.
About CVE-2023-4911
Dubbed “Looney Tunables”, CVE-2023-4911 is a buffer overflow vulnerability in the dynamic loader’s processing of the GLIBC_TUNABLES environment variable. To exploit it, attackers first need to establish access to the system.
“The GNU C Library, commonly known as glibc, is the C library in the GNU system and in most systems running the Linux kernel. It defines the system calls and other basic functionalities, such as open, malloc, printf, exit, etc., that a typical program requires,” Saeed Abbasi, product manager at Qualys’ Threat Research Unit, explained.
“The GNU C Library’s dynamic loader is a crucial component of glibc responsible for preparing and running programs. Given its role, the dynamic loader is highly security-sensitive, as its code runs with elevated privileges when a local user launches a set-user-ID or set-group-ID program.”
Qualys researchers discovered the vulnerability in glibc v2.34 manually, but they say it was also discoverable by fuzzing the vulnerable function.
They’ve detailed their research into the vulnerability’s potential for exploitation and shared that they exploited it to obtain full root privileges on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13.
They did not publish proof-of-concept exploit code, but noted that “the ease with which the buffer overflow can be transformed into a data-only attack implies that other research teams could soon produce and release exploits.”
POCs by other researchers have been published on GitHub.
Fixes are available
“While certain distributions like Alpine Linux are exempt due to their use of musl libc instead of glibc, many popular distributions are potentially vulnerable and could be exploited in the near future,” Abbasi noted.
By now, CVE-2023-4911 has been fixed in upstream glibc.
Linux distribution vendors are urging users to upgrade to a non-vulnerable version of the library: Ubuntu, RedHat, Debian, Fedora, Gentoo.
UPDATE (October 6, 2023, 04:20 a.m. ET):
Another PoC exploit – confirmed to work – has been published.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/10/05/cve-2023-4911/