CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability

Q: How do I fix CVE-2023-4911?

bootstrap os: mitigate or apply the listed mitigation; simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware: mitigate or apply the listed mitigation; simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Q: Is CVE-2023-4911 being exploited?

Yes. CVE-2023-4911 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2023-4911 affect?

CVE-2023-4911 affects bootstrap os, simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware, simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware. Severity is high (CVSS 7.8). A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables w

Q: How urgent is CVE-2023-4911?

Priority 82/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference

Patch now

HIGH 7.8EXPLOITEDMITIGATEMITIGATEMITIGATE

CVE-2023-4911 is a high-severity flaw (CVSS 7.8) affecting bootstrap os, simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware, simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	63.8% (top 1%)
CISA exploited list	Yes, fix due 2023-12-12
Weakness	CWE-122, CWE-787
Published	2023-10-03
Last modified	2026-10-14

Publisher (CNA): Red Hat, Inc. · Vendor: gnu · netapp · siemens

Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-10-03 18:15 UTCPublished CVE record published
2023-11-21Exploited Added to the CISA Known Exploited Vulnerabilities list
2023-12-12Deadline CISA due date for US federal agencies to patch
2026-10-14 22:17 UTCUpdated Record last modified

netapp bootstrap os MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

siemens simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware MITIGATE

Affected: >= 3.1.5

Fixed in: no fixed release known

Safe to downgrade to: a release before 3.1.5

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

siemens simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware MITIGATE

Affected: >= 3.1.5

Fixed in: no fixed release known

Safe to downgrade to: a release before 3.1.5

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

siemens siplus s7-1500 cpu 1518-4 pn\/dp mfp firmware MITIGATE

Affected: >= 3.1.5

Fixed in: no fixed release known

Safe to downgrade to: a release before 3.1.5

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

siemens simatic s7-1500 tm mfp firmware UPGRADE

Affected: < 1.1

Fixed in: 1.1

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

gnu glibc UPGRADE

Affected: >= 2.34 and < 2.39

Fixed in: 2.39

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy glibc || rpm -q glibc || glibc --version

2. UPGRADE to 2.39 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade glibc

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade glibc

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora ELN · libmamba · FIXED · 2.10.0-1.eln159 · FEDORA-2026-cc57be9e65 · source

sudo dnf upgrade --advisory=FEDORA-2026-cc57be9e65

Fedora 46 · rubygem-selenium-webdriver · FIXED · 4.34.0-5.fc46 · FEDORA-2026-111c6e6363 · source

sudo dnf upgrade --advisory=FEDORA-2026-111c6e6363

Ubuntu 20.04 · glibc · NOT AFFECTED

Ubuntu 22.04 · glibc · FIXED · 2.35-0ubuntu3.4

sudo apt update && sudo apt install --only-upgrade glibc dpkg --compare-versions "$(dpkg-query -W -f='${Version}' glibc)" ge "2.35-0ubuntu3.4" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.04 · glibc · FIXED · 2.38-1ubuntu6

sudo apt update && sudo apt install --only-upgrade glibc dpkg --compare-versions "$(dpkg-query -W -f='${Version}' glibc)" ge "2.38-1ubuntu6" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · glibc · FIXED · 2.36-9+deb12u3

sudo apt update && sudo apt install --only-upgrade glibc dpkg --compare-versions "$(dpkg-query -W -f='${Version}' glibc)" ge "2.36-9+deb12u3" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · glibc · FIXED · 2.37-12

sudo apt update && sudo apt install --only-upgrade glibc dpkg --compare-versions "$(dpkg-query -W -f='${Version}' glibc)" ge "2.37-12" && echo PATCHED || echo STILL-VULNERABLE

RHEL 8 · glibc · FIXED · glibc-2.28-225.el8_8.6

sudo dnf upgrade --advisory=RHSA-2023:5455 rpm -q glibc

RHEL 8.6 Extended Update Support · glibc · FIXED · glibc-2.28-189.6.el8_6

sudo dnf upgrade --advisory=RHSA-2023:5476 rpm -q glibc

RHEL 9 · glibc · FIXED · glibc-2.34-60.el9_2.7

sudo dnf upgrade --advisory=RHSA-2023:5453 rpm -q glibc

RHEL 9.0 Extended Update Support · glibc · FIXED · glibc-2.34-28.el9_0.4

sudo dnf upgrade --advisory=RHSA-2023:5454 rpm -q glibc

RHEL 6 · glibc · NOT AFFECTED

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2023-359 · source

sudo dnf update --advisory=ALAS2023-2023-359

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: leesh3288/CVE-2023-4911 (393 stars)
GitHub PoC: RickdeJager/CVE-2023-4911 (167 stars)
GitHub PoC: chaudharyarjun/LooneyPwner (43 stars)
Write-up: cert-portal.siemens.com/productcert/html/ssa-082556.html
Write-up: www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-l
GitHub PoC: Billar42/CVE-2023-4911
Exploit-DB: glibc 2.38 - Buffer Overflow
Metasploit: Glibc Tunables Privilege Escalation CVE-2023-4911 (aka Looney Tunables)

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-4911?

bootstrap os: mitigate or apply the listed mitigation; simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware: mitigate or apply the listed mitigation; simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2023-4911 being exploited?

Yes. CVE-2023-4911 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2023-4911 affect?

CVE-2023-4911 affects bootstrap os, simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware, simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware. Severity is high (CVSS 7.8). A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables w

How urgent is CVE-2023-4911?

Priority 82/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference

Software pages

glibc vulnerabilities · Siemens vulnerabilities · Bootstrap vulnerabilities

Related CVEs

CVE-2025-0665 HIGH 7.0 DOWNGRADE MITIGATE libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after
CVE-2024-8096 MEDIUM 6.5 UPGRADE MITIGATE When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to
CVE-2024-2466 MEDIUM 6.5 UPGRADE UPGRADE libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, whe
CVE-2024-2004 LOW 3.5 UPGRADE MITIGATE When a protocol selection parameter option disables all protocols without adding any then the default set of p
CVE-2024-1086 HIGH 7.8 EXPLOITED MITIGATE MITIGATE Linux Kernel Use-After-Free Vulnerability

References

← Back to latest CVEs