CVE-2023-4911
Memory Safety in Redhat Codeready Linux Builder Eus 8.6 … 9.6
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-4911 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Redhat Codeready Linux Builder Eus. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 0.8% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A buffer overflow vulnerability exists in the GNU C Library dynamic loader ld.so during handling of the GLIBC_TUNABLES environment variable. The flaw, tracked as CVE-2023-4911 and assigned CVSS 7.8, affects the processing logic that can be reached when SUID binaries are executed and matches CWE-122 and CWE-787.
A local attacker with the ability to set environment variables can supply a maliciously crafted GLIBC_TUNABLES value when invoking an SUID binary. Successful exploitation grants arbitrary code execution with the privileges of the binary owner, typically root.
Red Hat has published the advisories RHSA-2023:5453, RHSA-2023:5454, RHSA-2023:5455, RHSA-2023:5476, and RHSA-2024:0033 that deliver patched glibc packages. The associated EPSS score reached a peak of 0.7426 and currently stands at 0.6505, indicating material post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54750
Vulnerability Data
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to…
more
execute code with elevated privileges.
- CWE(s)
- KEV Date Added
- 21 November 2023
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.
Timely patching removes known heap-overflow instances after they exist.
Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.