Skip to content
Nuclei Templates

Looney Tunables Linux - Local Privilege Escalation

ID: CVE-2023-4911

Severity: high

Author: nybble04

Tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu

Description

Section titled “Description”

A buffer overflow was discovered in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

YAML Source

Section titled “YAML Source”
id: CVE-2023-4911


info:
  name: Looney Tunables Linux - Local Privilege Escalation
  author: nybble04
  severity: high
  description: |
    A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-4911
    - https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt
    - https://www.youtube.com/watch?v=1iV-CD9Apn8
    - http://www.openwall.com/lists/oss-security/2023/10/05/1
    - http://www.openwall.com/lists/oss-security/2023/10/13/11
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 7.8
    cve-id: CVE-2023-4911
    cwe-id: CWE-787,CWE-122
    epss-score: 0.0171
    epss-percentile: 0.87439
    cpe: cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: gnu
    product: glibc
  tags: cve,cve2023,code,glibc,looneytunables,linux,privesc,local,kev,gnu


self-contained: true
code:
  - engine:
      - sh
      - bash
    source: |
      env -i "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=`printf '%08192x' 1`" /usr/bin/su --help
      echo $?


    matchers:
      - type: word
        words:
          - "139"     # Segmentation Fault Exit Code
# digest: 4b0a004830460221009b0b0cfac42037ebc60fb784afe5b4b70d62670e925e5b173d8e9e1e88fdc163022100edfb6d5010a063cfdbe507710c75ef7c530b946d363571fad08d504e9e519505:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "code/cves/2023/CVE-2023-4911.yaml"

View on Github