Looney Tunables: a buffer overflow in the dynamic loader, reachable by any local user
The dynamic loader runs with full privilege when it starts a setuid program, and it reads an environment variable the caller controls. That combination is a local root exploit, and CISA has it in the Known Exploited catalogue.
A fixed package version is available on 5 of the releases below. Each row names the version, and the section below it says when this does not apply to you at all.
What it actually is
ld.so parses the GLIBC_TUNABLES environment variable when it loads a program. The parser mishandles a malformed value and overflows a buffer on the stack. Because the loader is already running as root by the time it does this for a setuid binary, the overflow happens with root privilege.
What an attacker gets: Full root from any local account, including a service account a web application runs as.
When it applies to you, and when it does not
An old package version and a real exposure are different things. These are the conditions this one needs.
- Local only. Nothing about it is reachable across a network on its own.
- What makes it serious is what it pairs with. Any foothold at all, a web shell running as www-data or a compromised FTP account, becomes root on an unpatched machine.
- It needs a setuid binary to be present, which on any normal system means sudo, su, passwd and several others.
Check your own server
ldd --version | head -1 && ls -l /usr/bin/sudo /bin/suThe glibc version and the presence of setuid binaries. Both are effectively always there, which is why the package version below is the answer.
Fixed package version, per distribution
From each distribution’s own advisory data, asked per release. A version here is the package version that carries the fix on that release, not the upstream release number.
| Release | Source package | State | Fixed in |
|---|---|---|---|
| Ubuntu 22.04 LTS | glibc | Fixed | 2.35-0ubuntu3.4 |
| Ubuntu 24.04 LTS | glibc | Fixed | 2.38-1ubuntu6 |
| Debian 12 (bookworm) | glibc | Fixed | 2.36-9+deb12u3 |
| Debian 13 (trixie) | glibc | Fixed | 2.37-12 |
| Rocky Linux 9 | glibc | No advisory names it | No Rocky Linux 9 advisory names it. AlmaLinux 9, rebuilt from the same Red Hat Enterprise Linux 9 source, fixed it in 2.34-60.el9_2.7 (ALSA-2023:5453). |
| AlmaLinux 9 | glibc | Fixed | 2.34-60.el9_2.7 |
Install the fix with apt update && apt install --only-upgrade libc6 libc-bin on Debian and Ubuntu, or dnf update glibc glibc-common on Rocky Linux and AlmaLinux. Restart whatever was using it afterwards: a patched file on disk is not a patched process in memory.
What SecAI has recorded about it
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Recorded from nvd. Its weakness class is CWE-122 and CWE-787, from NVD.
Read next
Other CVEs explained in full
Then check the rest of the server
The command above shows which version you run, and the table shows which version fixes CVE-2023-4911. One more read-only command, with no account and no agent, checks the rest of the server’s setup: SSH, the firewall, how many security updates are waiting, and signs that it has already been compromised. It changes nothing. It does not match your packages against advisories; SecAI’s agent does that, checking installed packages against published advisories every 12 hours.