GNU GNU C Library

CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability

Also known as Looney Tunables

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 21 Nov 2023, 49 days after the CVE record was published.

How likely is exploitation in the next 30 days?

63.8%

EPSS score, percentile 99.2 of all scored records

How severe?

7.8 High

CVSS v3.1 base score, given by the CNA

What should I do?

CISA deadline 12 Dec 2023. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Advisories and patches (5)

Which versions are affected?

Unaffected 0:2.28-225.el8_8.6; 0:2.28-225.el8_8.6; 0:2.28-189.6.el8_6; 0:2.34-60.el9_2.7; 0:2.34-60.el9_2.7; 0:2.34-28.el9_0.4; and 3 more

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.

What to do

Required action, set by CISA

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date for this action: 12 December 2023.

Workaround (from the CVE record)

For customers who cannot update immediately and do not have Secure Boot feature enabled, the issue can be mitigated using the provided SystemTap script with the following steps. When enabled, any setuid program invoked with GLIBC_TUNABLES in the environment will be terminated immediately. To invoke the setuid program, users will then have to unset or clear the GLIBC_TUNABLES envvar, e.g. `GLIBC_TUNABLES= sudo` . Note that these mitigation steps will need to be repeated if the system is rebooted. 1) Install required systemtap packages and dependencies as per - https://access.redhat.com/solutions/5441 2) Create the following systemtap script, and name it stap_block_suid_tunables.stp: ~~~ function has_tunable_string:long() { name = "GLIBC_TUNABLES" mm = @task(task_current())->mm; if (mm) { env_start = @mm(mm)->env_start; env_end = @mm(mm)->env_end; if (env_start != 0 && env_end != 0) while (env_end > env_start) { cur = user_string(env_start, ""); env_name = tokenize(cur, "="); if (env_name == name && tokenize("", "") != "") return 1; env_start += strlen (cur) + 1 } } return 0; } probe process("/lib*/ld*.so*").function("__tunables_init") { atsecure = 0; /* Skip processing if we can't read __libc_enable_secure, e.g. core dump handler (systemd-cgroups-agent and systemd-coredump). */ try { atsecure = @var("__libc_enable_secure"); } catch { printk (4, sprintf ("CVE-2023-4911: Skipped check: %s (%d)", execname(), pid())); } if (atsecure && has_tunable_string ()) raise (9); } ~~~ 3) Load the systemtap module into the running kernel: ~~~ stap -g -F -m stap_block_suid_tunables stap_block_suid_tunables.stp ~~~ 4) Ensure the module is loaded: ~~~ lsmod | grep -i stap_block_suid_tunables stap_block_suid_tunables 249856 0 ~~~ 5) Once the glibc package is updated to the version contai…

Advisories and patches

RHSA-2023:5453 (Vendor advisory)
RHSA-2023:5454 (Vendor advisory)
RHSA-2023:5455 (Vendor advisory)
RHSA-2023:5476 (Vendor advisory)
RHSA-2024:0033 (Vendor advisory)