glibc缓冲区溢出漏洞(Looney Tunables)

详细信息

漏洞类型

缓冲区错误

漏洞描述

glibc（GNU C Library）是GNU计划所实现的C标准库。glibc可能允许经过本地身份验证的攻击者在系统上获得提升的权限，这是由动态加载程序ld.so处理glibc_TTUNABLES环境变量时的缓冲区溢出引起的。可能使本地攻击者使用恶意编制的GLIBC_TTUNABLES环境变使用SUID权限启动二进制文件以执行具有提升权限的代码，攻击者可以利用此漏洞获得系统的root权限。

修复建议

此漏洞影响常见的开源组件、第三方库或不同产品使用的协议。请与特定供应商核实有关修补状态的信息。 GNU Libc： https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa https://www.gnu.org/software/libc/ RedHat： https://access.redhat.com/security/cve/cve-2023-4911 Debian： https://www.debian.org/security/2023/dsa-5514 IBM Cloud Object Storage Systems&MQ Operator： https://www.ibm.com/support/pages/node/7074657 https://www.ibm.com/support/pages/node/7064962 Oracle Linux： https://www.oracle.com/security-alerts/linuxbulletinoct2023.html Ubuntu： https://ubuntu.com/security/notices/USN-6409-1 Fedora： https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/ Gentoo： https://security.gentoo.org/glsa/202310-03 Amazon Linux： https://alas.aws.amazon.com/AL2023/ALAS-2023-359.html AlmaLinux： https://errata.almalinux.org/9/ALSA-2023-5453.html RockyLinux： https://errata.rockylinux.org/RLSA-2023:5455 NetAPP： https://security.netapp.com/advisory/ntap-20231013-0006/

参考链接

• https://www.hackthebox.com/blog/exploiting-the-looney-tunables-vulnerability-cve-2023-4911
• https://bugzilla.redhat.com/show_bug.cgi?id=2238352

  OSV · issue-tracking · x_refsource_REDHAT

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NDAQWHTSVOCOZ5K6KPIWKRT3JX4RTZUR/

  OSV · Mailing List

• https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

  OSV · Exploit

• http://packetstormsecurity.com/files/174986/glibc-ld.so-Local-Privilege-Escalation.html

  OSV · Exploit · Third Party Advisory

• https://access.redhat.com/errata/RHSA-2023:5455

  OSV · vendor-advisory · x_refsource_REDHAT

• http://www.openwall.com/lists/oss-security/2023/10/03/3

  OSV · Mailing List · Patch

• http://www.openwall.com/lists/oss-security/2023/10/14/3

  OSV · Mailing List

• https://www.qualys.com/cve-2023-4911/

  OSV · Third Party Advisory

• https://access.redhat.com/errata/RHSA-2023:5453

  OSV · vendor-advisory · x_refsource_REDHAT

• http://www.openwall.com/lists/oss-security/2023/10/05/1

  OSV · Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2023/10/14/6

  OSV · Third Party Advisory

• https://www.debian.org/security/2023/dsa-5514

  OSV · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2023/10/03/2

  OSV · Exploit · Mailing List

• https://security.netapp.com/advisory/ntap-20231013-0006/

  OSV · Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2023/10/13/11

  OSV · Mailing List

• https://access.redhat.com/errata/RHSA-2023:5454

  OSV · vendor-advisory · x_refsource_REDHAT

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DBUQRRPB47TC3NJOUIBVWUGFHBJAFDL/

  OSV · Mailing List

• https://security.gentoo.org/glsa/202310-03

  OSV · Third Party Advisory

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFG4P76UHHZEWQ26FWBXG76N2QLKKPZA/

  OSV · Exploit · Mailing List

• https://access.redhat.com/errata/RHSA-2023:5476

  OSV · vendor-advisory · x_refsource_REDHAT

• http://seclists.org/fulldisclosure/2023/Oct/11

  OSV · Exploit · Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2023/10/14/5

  OSV · Mailing List

• https://access.redhat.com/security/cve/CVE-2023-4911

  OSV · vdb-entry · x_refsource_REDHAT

• http://packetstormsecurity.com/files/176288/Glibc-Tunables-Privilege-Escalation.html

  OSV · Exploit · Third Party Advisory

• https://access.redhat.com/errata/RHSA-2024:0033

  OSV · vendor-advisory · x_refsource_REDHAT

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10
• https://sourceware.org/git/?p=glibc.git;a=commit;h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa

  Snyk

• https://github.com/bminor/glibc/commit/1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa

  Snyk

• https://github.com/projectdiscovery/nuclei-templates/blob/master/code/cves/2023/CVE-2023-4911.yaml

  Snyk

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  Snyk

• https://security.snyk.io/vuln/SNYK-UNMANAGED-GLIBC-5929486
• https://errata.rockylinux.org/RLSA-2023:5455

  OSV

• https://bugzilla.redhat.com/show_bug.cgi?id=2234712

  OSV

• https://bugzilla.redhat.com/show_bug.cgi?id=2237782

  OSV

• https://bugzilla.redhat.com/show_bug.cgi?id=2237798

  OSV

• https://osv.dev/vulnerability/RLSA-2023:5455

  OSV

• https://access.redhat.com/security/cve/CVE-2023-4527

  OSV

• https://access.redhat.com/security/cve/CVE-2023-4806

  OSV

• https://access.redhat.com/security/cve/CVE-2023-4813

  OSV

• https://bugzilla.redhat.com/2234712

  OSV

• https://bugzilla.redhat.com/2237782

  OSV

• https://bugzilla.redhat.com/2237798

  OSV

• https://bugzilla.redhat.com/2238352

  OSV

• https://errata.almalinux.org/8/ALSA-2023-5455.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5455

  OSV

• https://errata.almalinux.org/9/ALSA-2023-5453.html

  OSV

• https://osv.dev/vulnerability/ALSA-2023:5453

  OSV

• https://osv.dev/vulnerability/CVE-2023-4911

  OSV

• https://osv.dev/vulnerability/DSA-5514-1

  OSV

• https://security-tracker.debian.org/tracker/CVE-2023-4911

  OSV

• https://ubuntu.com/security/CVE-2023-4911

  OSV

• https://ubuntu.com/security/notices/USN-6409-1

  OSV

• https://www.cve.org/CVERecord?id=CVE-2023-4911

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4911

  OSV

• https://access.redhat.com/errata/RHBA-2024:2413

  CVE · vendor-advisory · x_refsource_REDHAT

• https://docs.bell-sw.com/security/cves/CVE-2023-4911

  OSV

• https://docs.bell-sw.com/security/advisories/BELL-SA-2023-2

  OSV

• https://osv.dev/vulnerability/BELL-CVE-2023-4911

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2023-4911

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911

  OSV · US Government Resource

• https://www.exploit-db.com/exploits/52479

  NVD · Third Party Advisory · VDB Entry · Exploit

• https://cert-portal.siemens.com/productcert/html/ssa-831302.html

  NVD · Third Party Advisory

• https://cert-portal.siemens.com/productcert/html/ssa-794697.html

  NVD · Third Party Advisory

• https://cert-portal.siemens.com/productcert/html/ssa-082556.html

  NVD · Third Party Advisory

• https://cxsecurity.com/cveshow/CVE-2023-4911/

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.5752

  CNNVD

• https://www.auscert.org.au/bulletins/ESB-2023.6406

  CNNVD

• https://cxsecurity.com/issue/WLB-2023100018

  CNNVD