erroneo.us
Search all guides⌘K

Security Digest · Oct 3, 2023 · Vulnerability · OS / kernel

Looney Tunables: glibc ld.so Local Root, CVE-2023-4911

glibc 2.34-2.38 ld.so overflow lets local users get root via SUID programs; Kinsing used it. Distros fixed it Oct 2023. Check old hosts and images.

Published By erroneo.us Security Desk · Updated 3 min read12 sources

Our verdict

Check exposure

Any Linux host or image patched since October 2023 is fine; the risk is old servers, unrebuilt container images and appliances still carrying glibc 2.34 to 2.38, where any foothold becomes root.

Who must act: Owners of Linux systems, container images or appliances built on glibc 2.34 to 2.38 (or RHEL 8 and Debian 11 backports) that have not taken a glibc update since October 2023.

Who can relax: Hosts on current Debian, Ubuntu, RHEL or Fedora packages, RHEL 7 and older, Debian 10, Ubuntu 20.04 and older, and musl-based systems such as Alpine, which Qualys says is not affected.

Affected
Upstream glibc 2.34 through 2.38 (fixed in 2.39 and on the release branches)
Debian 11 before 2.31-13+deb11u7 and Debian 12 before 2.36-9+deb12u3
Ubuntu 22.04 before 2.35-0ubuntu3.4 and Ubuntu 23.04 before 2.37-0ubuntu2.1
RHEL 8 before glibc-2.28-225.el8_8.6 and RHEL 9 before glibc-2.34-60.el9_2.7
Fedora 37 before glibc-2.36-14.fc37, Fedora 38 before glibc-2.37-10.fc38, Fedora 39 before glibc-2.38-6.fc39
Fixed in
glibc 2.39 upstream
Debian: 2.31-13+deb11u7 (bullseye), 2.36-9+deb12u3 (bookworm)
Ubuntu: 2.35-0ubuntu3.4 (22.04), 2.37-0ubuntu2.1 (23.04)
RHEL: glibc-2.28-225.el8_8.6 (RHSA-2023:5455), glibc-2.34-60.el9_2.7 (RHSA-2023:5453)
Fedora: glibc-2.36-14.fc37, glibc-2.37-10.fc38, glibc-2.38-6.fc39
CVSS
7.8 (v3.1, NVD)
EPSS
63.8% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
High

What to do

  1. Check the glibc package on every Linux host (dpkg -s libc6 or rpm -q glibc) and compare it with your distro's fixed version.
  2. Update glibc on anything below the fixed version with apt or dnf.
  3. Scan container images for CVE-2023-4911 and rebuild any built from a pre-October 2023 base layer.
  4. On a test box, run Qualys's one-line su check; a segmentation fault means the loader is still vulnerable.
  5. On RHEL systems that cannot update yet, load Red Hat's SystemTap script that kills SUID programs started with GLIBC_TUNABLES set.
  6. Ask appliance and embedded-Linux vendors whether their firmware ships an affected glibc.

How to check if you are affected or compromised

  • Look for bursts of segfaults from SUID programs such as su in the kernel log or in Apport/ABRT crash reports; the exploit brute-forces and crashes many times.
  • Search for gnu-acme.py (MD5 ea685e738adedc02ca1a63ebe8ed939e) and other exploit files in /tmp, and for downloads from haxx.in.
  • Check for Kinsing's chain: PHPUnit CVE-2017-9841 exploit requests, a reverse shell to port 1337, and traffic to 194.233.65.92.
  • Review web-server processes calling the cloud metadata service at 169.254.169.254, which Kinsing did after escalating.

What happened#

On October 3, 2023, Qualys disclosed "Looney Tunables" in a coordinated advisory. It is a buffer overflow in the way glibc's dynamic loader, ld.so, parses the GLIBC_TUNABLES environment variable. Because the loader runs with elevated privileges when a set-user-ID program starts, a local user can pass a crafted variable to su and become root. Qualys got root on default Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13. The upstream advisory says the flaw came in with glibc 2.34 and is fixed in 2.39 and on the stable branches. NVD scores it 7.8.

A month later, Aqua Nautilus reported that the Kinsing cryptomining group was using it. The attackers got in through an old PHPUnit bug, opened a reverse shell, pulled down a public exploit (gnu-acme.py) to try for root, and queried AWS instance metadata for cloud credentials. Aqua does not say whether the escalation worked. CISA added the CVE to KEV on November 21, 2023.

Who is affected#

Fixed packages:

  • Debian (DSA-5514-1): 2.31-13+deb11u7 for bullseye and 2.36-9+deb12u3 for bookworm. The tracker marks buster not affected; bullseye's 2.31 has the bug via a backport.
  • Ubuntu (CVE page): 2.35-0ubuntu3.4 for 22.04 and 2.37-0ubuntu2.1 for 23.04. Ubuntu 20.04 and older are not affected.
  • RHEL (Red Hat): glibc-2.28-225.el8_8.6 for RHEL 8 and glibc-2.34-60.el9_2.7 for RHEL 9. RHEL 6 and 7 are not affected.
  • Fedora: glibc-2.36-14.fc37 (update), glibc-2.37-10.fc38 (update) and glibc-2.38-6.fc39.

Containers carry their own glibc: an image built on a Debian, Ubuntu, Fedora or RHEL base before October 2023 and never rebuilt is still vulnerable on a patched host. Alpine uses musl and is not affected.

Do you really need to act?#

Most fleets do not: a routine package update fixed this three years ago. Exploitation is local only, so an attacker first needs code running as some user, via a web app bug as Kinsing did or a stolen login. After that the exploit is reliable, and Qualys found it works against almost every default SUID-root program. What remains is where patching misses: long-lived servers, golden VM images, stale container images and vendor appliances. In a container, the bug yields root in that container, which matters where it mounts host paths or holds secrets.

What to do now#

  1. Check the version against the list above: dpkg -s libc6 | grep Version or rpm -q glibc.
  2. Update: sudo apt update && sudo apt install --only-upgrade libc6 or sudo dnf upgrade glibc.
  3. Scan images, for example trivy image myimage:tag | grep CVE-2023-4911, and rebuild them from a current base.
  4. Test with Qualys's check: env -i "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=`printf '%08192x' 1`" /usr/bin/su --help. A segmentation fault means the loader is vulnerable.
  5. On a RHEL host that cannot update yet, use Red Hat's SystemTap mitigation, which kills SUID programs started with GLIBC_TUNABLES.

How to tell if you were hit#

The exploit brute-forces stack addresses (about 30 seconds on Debian and 5 minutes on Ubuntu and Fedora in Qualys's tests), so look for bursts of segfaults from su or other SUID binaries in journalctl -k or in Apport and ABRT crash reports. Aqua's indicators include gnu-acme.py (MD5 ea685e738adedc02ca1a63ebe8ed939e) dropped in /tmp, downloads from haxx.in, a reverse shell on port 1337, traffic to 194.233.65.92, and web processes calling 169.254.169.254. If you find signs of root access, rebuild the host and rotate its cloud credentials.

Timeline#

  • — Qualys sends its advisory and exploit to Red Hat.
  • — Coordinated disclosure, with Debian, Ubuntu, Fedora and upstream fixes.
  • — Red Hat ships fixed glibc for RHEL 8 and 9.
  • — Aqua Nautilus reports Kinsing using the bug.
  • — CISA adds CVE-2023-4911 to KEV.
  • — CISA's remediation deadline for federal agencies.

Vulnerability records

  • CVE-2023-4911 · KEV 2023-11-21 · A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Qualys — Looney Tunables: Local Privilege Escalation in the glibc's ld.so (CVE-2023-4911) qualys.com
  2. GNU C Library — GLIBC-SA-2023-0004 advisory sourceware.org
  3. CVE record — CVE-2023-4911 cve.org
  4. NVD — CVE-2023-4911 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2023-4911 cisa.gov
  6. Red Hat — CVE-2023-4911 access.redhat.com
  7. Debian — DSA-5514-1 glibc security update debian.org
  8. Debian security tracker — CVE-2023-4911 security-tracker.debian.org
  9. Ubuntu — CVE-2023-4911 ubuntu.com
  10. Fedora — FEDORA-2023-2b8c11ee75 (glibc-2.37-10.fc38) bodhi.fedoraproject.org
  11. Fedora — FEDORA-2023-028062484e (glibc-2.36-14.fc37) bodhi.fedoraproject.org
  12. Aqua Nautilus — Looney Tunables vulnerability exploited by Kinsing aquasec.com