What is CVE-2023-4911?

CVE-2023-4911 is a vulnerability affecting the GNU C Library's dynamic loader, ld.so, which is responsible foment variable, which could allow a local attacker to execute code with elevated privileges. The vulnerability has been successfully exploited on default installations of various Linux distributions, such as Fedora, Ubuntu, and Debian, suggesting that other distributions may also be affected, except for Alpine Linux, which uses a different library.

Who is impacted by CVE-2023-4911?

This vulnerability was introduced in glibc 2.34, released in April 2021, and affects all versions up to 2.39. Users of systems running glibc versions 2.34 and later may be at risk of a local attacker exploiting this buffer overflow vulnerability to execute code with elevated privileges.

What should I do if I’m affected?

If you're affected by the CVE-2023-4911 vulnerability, it's crucial to take action to protect your system. Here's a simple guide to help you:

1. Check your system for affected glibc versions (2.34 to 2.39).

2. Update your system to the latest glibc version or apply available patches.

3. Monitor security advisories for further updates and recommendations.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-4911 vulnerability, also known as "GNU C Library Buffer Overflow Vulnerability," is present in CISA's Known Exploited Vulnerabilities Catalog. It was added on November 21, 2023, with a due date of December 12, 2023. The required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787 (Out-of-bounds Write) and CWE-122 (Heap-based Buffer Overflow), related to a buffer overflow issue in the GNU C Library's dynamic loader.

Learn More

For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Qualys Security Advisory (Packet Storm)

• Qualys Security Advisory (Full Disclosure)

• Qualys Security Advisory (Openwall)