Looney Tunables Linux - Local Privilege Escalation

Exploited in the wild. Listed by CISA on 2023-11-21; known to be used by ransomware.

highseverity

7.8CVSS score

63.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Impact

Local attackers can execute arbitrary code with elevated privileges, potentially leading to full system compromise.

Fix

Upgrade GNU C Library (glibc) to a version later than affected releases that fixes the buffer overflow in the dynamic loader's GLIBC_TUNABLES environment variable processing.

How to confirm it

Positive when: contains "139"

Run it with nuclei: nuclei -id CVE-2023-4911 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-4911

info:
  name: Looney Tunables Linux - Local Privilege Escalation
  author: nybble04
  severity: high
  description: |
    A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
  remediation: |
    Upgrade GNU C Library (glibc) to a version later than affected releases that fixes the buffer overflow in the dynamic loader's GLIBC_TUNABLES environment variable processing.
  impact: |
    Local attackers can execute arbitrary code with elevated privileges, potentially leading to full system compromise.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4911
    - https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
    - https://www.youtube.com/watch?v=1iV-CD9Apn8
    - http://www.openwall.com/lists/oss-security/2023/10/05/1
    - http://www.openwall.com/lists/oss-security/2023/10/13/11
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
    epss-score: 0.63769
    epss-percentile: 0.99226
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: gnu
    product: glibc
  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu,vkev,vuln

self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      env -i "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=`printf '%08192x' 1`" /usr/bin/su --help
      echo $?

    matchers:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code

References

Use this check only on systems you are authorised to test. Where the data comes from