CVE-2023-4911

HIGHCISA KEVEPSS 100th pctl

7.8

CVSS v3

Description

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CWE-122Heap-based Buffer Overflow CWE-787Out-of-bounds Write

How to fix

Remediation Available

glibcDebian

Fixed in:2.31-13+deb11u7CVE-2023-4911

Fixed in:2.36-9+deb12u3CVE-2023-4911

Fixed in:2.37-12CVE-2023-4911

compat-libpthread-nonsharedRed Hat / RHEL

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

compat-libpthread-nonsharedRocky

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibcRed Hat / RHEL

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibcRocky

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

glibc-all-langpacksRocky

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

glibc-all-langpacksRed Hat / RHEL

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-all-langpacks-debuginfoRed Hat / RHEL

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-all-langpacks-debuginfoRocky

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-benchtestsRocky

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

glibc-benchtestsRed Hat / RHEL

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

glibc-benchtests-debuginfoRed Hat / RHEL

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

glibc-benchtests-debuginfoRocky

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

glibc-commonRocky

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-commonRed Hat / RHEL

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-common-debuginfoRed Hat / RHEL

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-common-debuginfoRocky

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-debuginfoRed Hat / RHEL

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-debuginfoRocky

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-debugsourceRed Hat / RHEL

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-debugsourceRocky

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-develRocky

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-develRed Hat / RHEL

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-docRed Hat / RHEL

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.34-60.el9_2.7RHSA-2023:5453

Fixed in:0:2.34-28.el9_0.4RHSA-2023:5454

glibc-docRocky

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.34-28.el9_0.4RHSA-2023:5454

Fixed in:0:2.34-60.el9_2.7RHSA-2023:5453

glibc-gconv-extraRed Hat / RHEL

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-gconv-extraRocky

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-gconv-extra-debuginfoRed Hat / RHEL

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-gconv-extra-debuginfoRocky

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

glibc-headersRed Hat / RHEL

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

Fixed in:0:2.28-225.el8_8.6RHSA-2023:5455

Fixed in:0:2.28-189.6.el8_6RHSA-2023:5476

This vulnerability affects an unusually large number of packages. The highest-confidence fixes are shown above; the full list is longer. Check the referenced advisories for complete coverage.

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

81.42%probability of exploitation in 30 days

100thpercentile

Very high risk: more likely to be exploited than 100% of all known CVEs.

Known Exploited Vulnerability (CISA KEV)

GNU C Library Buffer Overflow Vulnerability

GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Remediation due: 2023-12-12

References

Related Vulnerabilities

Other CWE-122 (Heap-based Buffer Overflow) vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2015-3113	Critical	9.8	100%	KEV	Fix
CVE-2024-26256	High	7.8	88%	-	Fix
CVE-2020-25687	Medium	5.9	87%	-	Fix
CVE-2009-3459	High	8.8	87%	KEV	Fix
CVE-2021-21017	High	8.8	86%	KEV	-
CVE-2020-25683	Medium	5.9	86%	-	Fix

Common questions

How do I fix CVE-2023-4911?

Published advisories record a fix for 189 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.

Is CVE-2023-4911 being actively exploited?

Yes. CVE-2023-4911 is listed in the CISA Known Exploited Vulnerabilities catalog, which means exploitation has been observed in the wild. US federal agencies were required to remediate it by 2023-12-12. Treat it as a priority whatever its CVSS score says.

How severe is CVE-2023-4911?

CVE-2023-4911 has a CVSS v3 base score of 7.8, rated high. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2023-4911 affect?

Published advisories record a fix for glibc (Debian), compat-libpthread-nonshared (Red Hat / RHEL), compat-libpthread-nonshared (Rocky), glibc (Red Hat / RHEL), and 185 more. The list on this page is capped, so there may be more.

Embed a live status badge for CVE-2023-4911

Markdown

[![CVE-2023-4911](https://tridentstack.com/cve/badge/CVE-2023-4911.svg)](https://tridentstack.com/cve/CVE-2023-4911)

HTML

<a href="https://tridentstack.com/cve/CVE-2023-4911"><img src="https://tridentstack.com/cve/badge/CVE-2023-4911.svg" alt="CVE-2023-4911"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it works Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-05-12.