Pierluigi Paganini October 06, 2023

Researchers published PoC exploits for CVE-2023-4911 vulnerability (aka Looney Tunables) impacting most popular Linux distributions.

The vulnerability CVE-2023-4911 (CVSS score 7.8) is a buffer overflow issue that resides in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. An attacker can trigger the vulnerability to execute code with elevated privileges.

“A buffer overflow was discovered in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.” reads the advisory.

The vulnerability, also named Looney Tunables, was disclosed last week by researchers at Qualys’ Threat Research Unit, which also published a PoC exploit. The buffer overflow affects multiple Linux distros, including Debian, Fedora, and Ubuntu.

The researchers highlighted the widespread nature of this vulnerability.

“We have successfully identified and exploited this vulnerability (a local privilege escalation that grants full root privileges) on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13.” reads the post published by Qualys. “It’s likely that other distributions are similarly susceptible, although we’ve noted that Alpine Linux remains an exception due to its use of musl libc instead of glibc. This vulnerability was introduced in April 2021.”

Multiple security researchers have already developed their own proof-of-concept exploits for this flaw.

“Although we are withholding our exploit code for now, the ease with which the buffer overflow can be transformed into a data-only attack implies that other research teams could soon produce and release exploits. This could put countless systems at risk, especially given the extensive use of glibc across Linux distributions.” concludes the report. “While certain distributions like Alpine Linux are exempt due to their use of musl libc instead of glibc, many popular distributions are potentially vulnerable and could be exploited in the near future.”

Below is the disclosure timeline:

• 2023-09-04: Advisory and exploit sent to secalert@redhat.
• 2023-09-19: Advisory and patch sent to linux-distros@openwall.
• 2023-10-03: Coordinated Release Date (17:00 UTC).

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Linux Looney Tunables flaw)