Keypoints
- Qualys found a buffer overflow in the dynamic loader (ld.so) when parsing GLIBC_TUNABLES, tracked as CVE-2023-4911 (high severity).
- The flaw arises during __tunables_init, where tunables_strdup uses __minimal_malloc (mmap-backed) before GLIBC is fully initialized.
- Parsing inputs like “tunable1=tunable2=value” can cause extra data to be copied, overflowing the allocated buffer and corrupting link_map structures (DT_RPATH pointer).
- An attacker can modify GLIBC_TUNABLES or LD_LIBRARY_PATH for setuid binaries to force loading of attacker-controlled shared objects, enabling local root execution.
- Exploitation is feasible in minutes using brute-force attempts against ASLR; proof-of-concept exploits exist.
- Detection: Falco rules can flag processes with GLIBC_TUNABLES in their environment that exit with SIGSEGV (segfault) to reduce false positives.
- Mitigation: apply vendor patches promptly; vendors (e.g., Red Hat) also provide detection/mitigation guidance such as SystemTap-based checks.
MITRE Techniques
- [T1068] Exploitation for Privilege Escalation – local attacker crafts GLIBC_TUNABLES payloads to overflow loader memory and gain root via setuid binaries (‘…a buffer overflow was found in the code responsible for handling special environment variables during the startup of a process which can result in a local privilege escalation.’)
- [T1203] Exploitation of Vulnerability – attackers exploit a heap/memory overflow in ld.so parsing logic; fuzzing reproduced crashes quickly (‘…fuzzing the logic with AFL++ or Libfuzzer was able to reproduce the crash in seconds.’)
- [T1574] Hijack Execution Flow – payloads corrupt link_map/DT_RPATH to force loading of attacker-controlled shared objects (‘…modify that pointer could lead to the binary loading shared objects from untrusted directories’)
- [T1548] Abuse Elevation Control Mechanism – attackers target SUID binaries by setting GLIBC_TUNABLES or LD_LIBRARY_PATH to influence loader behavior and execute code as root (‘…modifying the LD_LIBRARY_PATH for a given suid binary or making a copy, allowing processes to load untrusted shared objects from an attacker-controlled directory.’)
- [T1110] Brute Force – exploitation relies on repeated attempts to guess a valid pointer inside large address space to bypass ASLR (‘…there’s a good chance that the pointer will be valid after 2,730 tries. In a loop on a host, this takes mere minutes.’)
Indicators of Compromise
- [Environment Variable] targeted variable used to trigger overflow – GLIBC_TUNABLES (e.g., GLIBC_TUNABLES=glibc…), and LD_LIBRARY_PATH abuse to load untrusted shared objects
- [File Path / Binary] dynamic loader used to list tunables or parse env – /lib64/ld-linux-x86-64.so.2 (used with “–list-tunables”)
- [Vulnerability ID] reference for tracking and patching – CVE-2023-4911
- [Git Commit] code change that introduced the flaw – commit 2ed18c5b534d9e92fc006202a5af0df6b72e7aca (in __tunables_init)
- [Signal/Event] runtime symptom useful for detection – SIGSEGV (segmentation fault) during process exit after providing GLIBC_TUNABLES, observable by Falco
The GLIBC_TUNABLES parsing flaw occurs in the dynamic linker’s __tunables_init routine: when ld.so finds GLIBC_TUNABLES it duplicates the string via tunables_strdup, which relies on __minimal_malloc (mmap-backed) because GLIBC is not yet fully initialized. A specially crafted tunable string containing nested key-value patterns (for example, “tunable1=tunable2=value”) causes the parser to treat the same bytes twice and copy more data than the buffer holds, producing a heap overflow that can corrupt adjacent structures.
An exploit pads the environment (including NULL bytes) to overflow into the link_map’s l_info/DT_RPATH pointer; by controlling that pointer an attacker can redirect the dynamic loader to resolve libraries from attacker-controlled directories. This technique is particularly dangerous for setuid binaries, where loading a malicious shared object yields code execution as root. Practical exploitation does not bypass ASLR directly but relies on brute-force attempts against the large virtual address space (estimated ~2,730 tries to hit a valid pointer), making successful escalation possible in minutes on an accessible host.
Detection and mitigation: at runtime, watch for processes launched with GLIBC_TUNABLES in their environment that subsequently crash with SIGSEGV—Falco rules can express this by checking proc.env contains “GLIBC_TUNABLES=glibc.” and evt.arg.sig=SIGSEGV on procexit events to reduce false positives. The primary mitigation is to apply vendor patches; vendors like Red Hat also provide SystemTap-based detection to find binaries that inherit GLIBC_TUNABLES and terminate or remediate them until patched.
Read more: https://sysdig.com/blog/cve-2023-4911/