Glibc: buffer overflow in ld.so leading to privilege escalationCVE-2023-4911

Why this deserves its current priority

CVSS is 7.8. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps glibc (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 TM MFP - GNU/Linux subsystem (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for glibc, Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP.
2. 2Review the reported fix. Source-reported workaround: For customers who cannot update immediately and do not have Secure Boot feature enabled, the issue can be mitigated using the provided SystemTap script with the following steps. When enabled, any setuid program invoked with GLIBC_TUNABLES in the environment will be terminated immediately. To invoke the setuid program, users will then have to unset or clear the GLIBC_TUNABLES envvar, e.g. `GLIBC_TUNABLES= sudo` . Note that these mitigation steps will need to be repeated if the system is rebooted. 1) Install required systemtap packages and dependencies as per - https://access.redhat.com/solutions/5441 2) Create the following systemtap script, and name it stap_block_suid_tunables.stp: ~~~ function has_tunable_string:long() { name = "GLIBC_TUNABLES" mm = @task(task_current())->mm; if (mm) { env_start = @mm(mm)->env_start; env_end = @mm(mm)->env_end; if (env_start != 0 && env_end != 0) while (env_end > env_start) { cur = user_string(env_start, ""); env_name = tokenize(cur, "="); if (env_name == name && tokenize("", "") != "") return 1; env_start += strlen (cur) + 1 } } return 0; } probe process("/lib*/ld*.so*").function("__tunables_init") { atsecure = 0; /* Skip processing if we can't read __libc_enable_secure, e.g. core dump handler (systemd-cgroups-agent and systemd-coredump). */ try { atsecure = @var("__libc_enable_secure"); } catch { printk (4, sprintf ("CVE-2023-4911: Skipped check: %s (%d)", execname(), pid())); } if (atsecure && has_tunable_string ()) raise (9); } ~~~ 3) Load the systemtap module into the running kernel: ~~~ stap -g -F -m stap_block_suid_tunables stap_block_suid_tunables.stp ~~~ 4) Ensure the module is loaded: ~~~ lsmod | grep -i stap_block_suid_tunables stap_block_suid_tunables 249856 0 ~~~ 5) Once the glibc package is updated to the version containing the fix, the systemtap generated kernel module can be removed by running: ~~~ rmmod stap_block_suid_tunables ~~~ If Secure Boot is enabled on a system, the SystemTap module must be signed. An external compiling server can be used to sign the generated kernel module with a key enrolled into the kernel's keyring or starting with SystemTap 4.7 you can sign a module without a compile server. See further information here - https://www.redhat.com/sysadmin/secure-boot-systemtap

Evidence timeline and material changes

1. Published upstream

   Oct 3, 2023

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Oct 14, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   May 24, 2026

4. Added to CISA KEV

   Nov 21, 2023

   Evidence: source:kev:kev:kev:record

Sources and claim methodology

• Source referencepacketstormsecurity.com
• Source referencepacketstormsecurity.com
• Source referenceaccess.redhat.com
• Source referenceaccess.redhat.com
• Source referenceaccess.redhat.com
• Source referenceaccess.redhat.com
• Source referenceaccess.redhat.com
• Source referenceaccess.redhat.com
• Source referencebugzilla.redhat.com
• Source referencecert-portal.siemens.com
• Source referencecert-portal.siemens.com
• Source referencecert-portal.siemens.com
• Source referenceseclists.org
• Source referencelists.fedoraproject.org
• Source referencelists.fedoraproject.org
• Source referencelists.fedoraproject.org
• Source referencesecurity.gentoo.org
• Source referencesecurity.netapp.com
• CISA Known Exploited Vulnerabilities catalogcisa.gov
• Source referencedebian.org
• Source referenceexploit-db.com
• Source referencequalys.com
• Source referencequalys.com
• Source referenceopenwall.com
• Source referenceopenwall.com
• Source referenceopenwall.com
• Source referenceopenwall.com
• Source referenceopenwall.com
• Source referenceopenwall.com
• Source referenceopenwall.com

Related CVEs

• Tanium addressed a heap-based buffer overflow vulnerability in Deploy.Also CWE-122
• IrfanView TIFF Wang Annotation heap-based overflowAlso CWE-122