Major Linux Distributions Vulnerable to Severe glibc Privilege Escalation Flaw

October 4, 2023

A critical local privilege escalation vulnerability, designated as CVE-2023-4911, has been discovered in the GNU C Library (glibc) which is used by major Linux distributions such as Debian, Fedora, and Ubuntu. This flaw could potentially be exploited by malicious entities to gain full root access. The GNU C Library, or glibc, is a crucial component of GNU and most Linux kernel-based systems, as it defines system calls and other functionalities that are typically required by a program. The vulnerability in question, dubbed ‘Looney Tunables’, affects glibc’s dynamic loader, the component responsible for loading the necessary libraries into memory and linking them with the executable during runtime.

The dynamic loader carries out the task of resolving symbol references and preparing everything for the execution of the program. The CVE-2023-4911 vulnerability specifically affects the dynamic loader’s handling of GLIBC_TUNABLES environment variables, or ‘tunables’, which enable users to modify the library’s behavior at runtime by adjusting various parameters. As per the security firm Qualys, which discovered the vulnerability, “The dynamic loader is extremely security sensitive, because its code runs with elevated privileges when a local user executes a set-user-ID program, a set-group-ID program, or a program with capabilities.”

The vulnerability lies in the glibc dynamic loader’s processing of the tunables variables, which is prone to a buffer overflow that can be exploited to gain full root privileges on the affected system. This flaw was first introduced in glibc 2.34, released in April 2021, and has been successfully exploited on Debian 12 and 13, Fedora 37 and 38, and Ubuntu 22.04 and 23.04. Other Linux distributions could also be affected, with the exception of Alpine Linux that uses musl libc instead of glibc.

The vulnerability is caused by the way the dynamic loader’s processing function sanitizes tunables. The function eliminates all harmful tunables but retains specific ones. As a result, a specially crafted environment variable can cause the tunable to be processed twice, leading to a buffer overflow. Because the vulnerability could potentially grant full root privileges and is relatively straightforward to exploit, Qualys has chosen not to disclose its proof-of-concept (PoC) code. However, it did provide a detailed technical analysis. Qualys stated, “Our successful exploitation, leading to full root privileges on major distributions like Fedora, Ubuntu, and Debian, highlights this vulnerability’s severity and widespread nature. Although we are withholding our exploit code for now, the ease with which the buffer overflow can be transformed into a data-only attack implies that other research teams could soon produce and release exploits.”

The vulnerability has been fixed in the upstream glibc. Linux distributions including Debian, Gentoo Linux, Red Hat, and Ubuntu have already issued patches.

Latest News

• Cisco Addresses Critical Security Flaw in Emergency Responder
• Atlassian Issues Critical Patch for Confluence Zero-Day Exploitation
• Google's October 2023 Security Update for Android Fixes Actively Exploited Zero-days
• Critical Security Flaws Discovered in PyTorch Models: Remote Code Execution Possible
• Qualcomm Reports Active Exploitation of Zero-Day Vulnerabilities in GPU, DSP Drivers