Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-4911 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Redhat Codeready Linux Builder Eus. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A buffer overflow vulnerability exists in the GNU C Library dynamic loader ld.so during handling of the GLIBC_TUNABLES environment variable. The flaw, tracked as CVE-2023-4911 and assigned CVSS 7.8, affects the processing logic that can be reached when SUID binaries are executed and matches CWE-122 and CWE-787.
A local attacker with the ability to set environment variables can supply a maliciously crafted GLIBC_TUNABLES value when invoking an SUID binary. Successful exploitation grants arbitrary code execution with the privileges of the binary owner, typically root.
Red Hat has published the advisories RHSA-2023:5453, RHSA-2023:5454, RHSA-2023:5455, RHSA-2023:5476, and RHSA-2024:0033 that deliver patched glibc packages. The associated EPSS score reached a peak of 0.7426 and currently stands at 0.6505, indicating material post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54750
Vulnerability Data
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to…
more
execute code with elevated privileges.
- CWE(s)
- KEV Date Added
- 21 November 2023
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.4.1
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices directly require bounds checking and safe memory handling that prevent heap overflows.
Vulnerability scanning and recording can discover heap-overflow flaws but does not prevent their introduction in code.
Timely patching removes known heap-overflow instances after they exist.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect heap overflows before release.
Secure development lifecycle mandates practices that reduce the likelihood of introducing heap overflows.
Application security requirements can specify bounds-checking and safe memory APIs that mitigate heap overflows.
Secure architecture and engineering principles include memory-safety and input-validation controls that address heap overflows.
Secure coding standards directly prescribe techniques (safe functions, bounds checks) that prevent heap-based buffer overflows.
Change management can enforce review gates that catch unsafe memory operations before deployment.