Exploited in the wild · glibc · CVSS 7.8 · published 3 October 2023
Looney Tunables: CVE-2023-4911
A buffer overflow in the glibc dynamic loader's handling of the GLIBC_TUNABLES environment variable that lets a local user gain root. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 1end-of-life systems without a free fix
- 8fixed or not affected
Looney Tunables on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | Not affected | Red Hat security data |
| CentOS 7 | Not affected | Red Hat security data |
| RHEL 7 | Not affected | Red Hat security data |
| CentOS 8 | No free fix | Red Hat fixed it on 5 October 2023, after this release's end of life |
| Ubuntu 16.04 | Not affected | code not present |
| Ubuntu 18.04 | Not affected | code not present |
| Ubuntu 20.04 | Not affected | code not present |
| Debian 10 | Not affected | Debian security tracker |
| Debian 11 | Fixed | 2.31-13+deb11u7, DSA-5514-1 |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
What the NVD record says
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Score 7.8 (High), published 3 October 2023. Listed in the CISA catalogue of known exploited vulnerabilities on 21 November 2023. Read the NVD entry
Affected upstream versions of glibc
- glibc from 2.34 before 2.39
What you can do
Keep glibc, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.