CVE-2023-4911 PoC — Glibc: buffer overflow in ld.so leading to privilege escalation

Source

https://github.com/Green-Avocado/CVE-2023-4911

Associated Vulnerability

Title:Glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911)
Description:A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Description

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

Readme

# CVE-2023-4911

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

Proof-of-Concept

Developed for:

- Ubuntu 22.04
- Ubuntu GLIBC 2.35-0ubuntu3.1
- su from util-linux 2.37.2
- ASLR ON

Dockerfile included.

## Debug

Disable ASLR

```
$ echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
```

Compile with `NO_ASLR`

```
$ python3 patch.py
$ gcc poc.c -o poc_debug -DNO_ASLR
```

Run gdbscript

```
gdb -ix gdbscript
```

## Build

```
$ python3 patch.py
$ gcc poc.c -o poc
```

## Usage

```
./poc; while [ $? -ne 0 ]; do ./poc; done
```

File Snapshot


 [4.0K]  /data/pocs/95475cfda740f5b01dd7edc5ef2e3e6d6feee5c8
├── [ 499]  Dockerfile
├── [ 344]  gdbscript
├── [ 715]  patch.py
├── [1.5K]  poc.c
└── [ 601]  README.md

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!