---
title: "Looney Tunables: glibc ld.so Local Root, CVE-2023-4911"
url: https://erroneo.us/security/briefs/looney-tunables-glibc-ld-so-cve-2023-4911/
description: "glibc 2.34-2.38 ld.so overflow lets local users get root via SUID programs; Kinsing used it. Distros fixed it Oct 2023. Check old hosts and images."
type: security-brief
section: "Security Digest"
date_published: 2023-10-03
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-4911"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Looney Tunables: glibc ld.so Local Root, CVE-2023-4911

**Verdict: Check exposure.** Any Linux host or image patched since October 2023 is fine; the risk is old servers, unrebuilt container images and appliances still carrying glibc 2.34 to 2.38, where any foothold becomes root.

- **Who must act:** Owners of Linux systems, container images or appliances built on glibc 2.34 to 2.38 (or RHEL 8 and Debian 11 backports) that have not taken a glibc update since October 2023.
- **Who can relax:** Hosts on current Debian, Ubuntu, RHEL or Fedora packages, RHEL 7 and older, Debian 10, Ubuntu 20.04 and older, and musl-based systems such as Alpine, which Qualys says is not affected.
- **Affected:** Upstream glibc 2.34 through 2.38 (fixed in 2.39 and on the release branches); Debian 11 before 2.31-13+deb11u7 and Debian 12 before 2.36-9+deb12u3; Ubuntu 22.04 before 2.35-0ubuntu3.4 and Ubuntu 23.04 before 2.37-0ubuntu2.1; RHEL 8 before glibc-2.28-225.el8_8.6 and RHEL 9 before glibc-2.34-60.el9_2.7; Fedora 37 before glibc-2.36-14.fc37, Fedora 38 before glibc-2.37-10.fc38, Fedora 39 before glibc-2.38-6.fc39
- **Fixed:** glibc 2.39 upstream; Debian: 2.31-13+deb11u7 (bullseye), 2.36-9+deb12u3 (bookworm); Ubuntu: 2.35-0ubuntu3.4 (22.04), 2.37-0ubuntu2.1 (23.04); RHEL: glibc-2.28-225.el8_8.6 (RHSA-2023:5455), glibc-2.34-60.el9_2.7 (RHSA-2023:5453); Fedora: glibc-2.36-14.fc37, glibc-2.37-10.fc38, glibc-2.38-6.fc39
- **CVEs:** CVE-2023-4911
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the glibc package on every Linux host (dpkg -s libc6 or rpm -q glibc) and compare it with your distro's fixed version.
2. Update glibc on anything below the fixed version with apt or dnf.
3. Scan container images for CVE-2023-4911 and rebuild any built from a pre-October 2023 base layer.
4. On a test box, run Qualys's one-line su check; a segmentation fault means the loader is still vulnerable.
5. On RHEL systems that cannot update yet, load Red Hat's SystemTap script that kills SUID programs started with GLIBC_TUNABLES set.
6. Ask appliance and embedded-Linux vendors whether their firmware ships an affected glibc.

### How to check if you are affected

- Look for bursts of segfaults from SUID programs such as su in the kernel log or in Apport/ABRT crash reports; the exploit brute-forces and crashes many times.
- Search for gnu-acme.py (MD5 ea685e738adedc02ca1a63ebe8ed939e) and other exploit files in /tmp, and for downloads from haxx.in.
- Check for Kinsing's chain: PHPUnit CVE-2017-9841 exploit requests, a reverse shell to port 1337, and traffic to 194.233.65.92.
- Review web-server processes calling the cloud metadata service at 169.254.169.254, which Kinsing did after escalating.

## What happened

On October 3, 2023, Qualys disclosed "Looney Tunables" in a [coordinated advisory](https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt). It is a buffer overflow in the way glibc's dynamic loader, `ld.so`, parses the `GLIBC_TUNABLES` environment variable. Because the loader runs with elevated privileges when a set-user-ID program starts, a local user can pass a crafted variable to `su` and become root. Qualys got root on default Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13. The [upstream advisory](https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2023-0004) says the flaw came in with glibc 2.34 and is fixed in 2.39 and on the stable branches. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-4911) scores it 7.8.

A month later, [Aqua Nautilus](https://www.aquasec.com/blog/loony-tunables-vulnerability-exploited-by-kinsing/) reported that the Kinsing cryptomining group was using it. The attackers got in through an old PHPUnit bug, opened a reverse shell, pulled down a public exploit (`gnu-acme.py`) to try for root, and queried AWS instance metadata for cloud credentials. Aqua does not say whether the escalation worked. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911) on November 21, 2023.

## Who is affected

Fixed packages:

- **Debian** ([DSA-5514-1](https://www.debian.org/security/2023/dsa-5514)): 2.31-13+deb11u7 for bullseye and 2.36-9+deb12u3 for bookworm. The [tracker](https://security-tracker.debian.org/tracker/CVE-2023-4911) marks buster not affected; bullseye's 2.31 has the bug via a backport.
- **Ubuntu** ([CVE page](https://ubuntu.com/security/CVE-2023-4911)): 2.35-0ubuntu3.4 for 22.04 and 2.37-0ubuntu2.1 for 23.04. Ubuntu 20.04 and older are not affected.
- **RHEL** ([Red Hat](https://access.redhat.com/security/cve/cve-2023-4911)): glibc-2.28-225.el8_8.6 for RHEL 8 and glibc-2.34-60.el9_2.7 for RHEL 9. RHEL 6 and 7 are not affected.
- **Fedora**: glibc-2.36-14.fc37 ([update](https://bodhi.fedoraproject.org/updates/FEDORA-2023-028062484e)), glibc-2.37-10.fc38 ([update](https://bodhi.fedoraproject.org/updates/FEDORA-2023-2b8c11ee75)) and glibc-2.38-6.fc39.

Containers carry their own glibc: an image built on a Debian, Ubuntu, Fedora or RHEL base before October 2023 and never rebuilt is still vulnerable on a patched host. Alpine uses musl and is not affected.

## Do you really need to act?

Most fleets do not: a routine package update fixed this three years ago. Exploitation is local only, so an attacker first needs code running as some user, via a web app bug as Kinsing did or a stolen login. After that the exploit is reliable, and Qualys found it works against almost every default SUID-root program. What remains is where patching misses: long-lived servers, golden VM images, stale container images and vendor appliances. In a container, the bug yields root in that container, which matters where it mounts host paths or holds secrets.

## What to do now

1. Check the version against the list above: `dpkg -s libc6 | grep Version` or `rpm -q glibc`.
2. Update: `sudo apt update && sudo apt install --only-upgrade libc6` or `sudo dnf upgrade glibc`.
3. Scan images, for example `trivy image myimage:tag | grep CVE-2023-4911`, and rebuild them from a current base.
4. Test with Qualys's check: `env -i "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=`printf '%08192x' 1`" /usr/bin/su --help`. A segmentation fault means the loader is vulnerable.
5. On a RHEL host that cannot update yet, use Red Hat's SystemTap mitigation, which kills SUID programs started with `GLIBC_TUNABLES`.

## How to tell if you were hit

The exploit brute-forces stack addresses (about 30 seconds on Debian and 5 minutes on Ubuntu and Fedora in Qualys's tests), so look for bursts of segfaults from `su` or other SUID binaries in `journalctl -k` or in Apport and ABRT crash reports. Aqua's indicators include `gnu-acme.py` (MD5 `ea685e738adedc02ca1a63ebe8ed939e`) dropped in `/tmp`, downloads from `haxx.in`, a reverse shell on port 1337, traffic to `194.233.65.92`, and web processes calling `169.254.169.254`. If you find signs of root access, rebuild the host and rotate its cloud credentials.

## Timeline

- Sep 4, 2023 — Qualys sends its advisory and exploit to Red Hat.
- Oct 3, 2023 — Coordinated disclosure, with Debian, Ubuntu, Fedora and upstream fixes.
- Oct 5, 2023 — Red Hat ships fixed glibc for RHEL 8 and 9.
- Nov 3, 2023 — Aqua Nautilus reports Kinsing using the bug.
- Nov 21, 2023 — CISA adds CVE-2023-4911 to KEV.
- Dec 12, 2023 — CISA's remediation deadline for federal agencies.

## Sources

1. [Qualys — Looney Tunables: Local Privilege Escalation in the glibc's ld.so (CVE-2023-4911)](https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt)
2. [GNU C Library — GLIBC-SA-2023-0004 advisory](https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2023-0004)
3. [CVE record — CVE-2023-4911](https://www.cve.org/CVERecord?id=CVE-2023-4911)
4. [NVD — CVE-2023-4911](https://nvd.nist.gov/vuln/detail/CVE-2023-4911)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-4911](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-4911)
6. [Red Hat — CVE-2023-4911](https://access.redhat.com/security/cve/cve-2023-4911)
7. [Debian — DSA-5514-1 glibc security update](https://www.debian.org/security/2023/dsa-5514)
8. [Debian security tracker — CVE-2023-4911](https://security-tracker.debian.org/tracker/CVE-2023-4911)
9. [Ubuntu — CVE-2023-4911](https://ubuntu.com/security/CVE-2023-4911)
10. [Fedora — FEDORA-2023-2b8c11ee75 (glibc-2.37-10.fc38)](https://bodhi.fedoraproject.org/updates/FEDORA-2023-2b8c11ee75)
11. [Fedora — FEDORA-2023-028062484e (glibc-2.36-14.fc37)](https://bodhi.fedoraproject.org/updates/FEDORA-2023-028062484e)
12. [Aqua Nautilus — Looney Tunables vulnerability exploited by Kinsing](https://www.aquasec.com/blog/loony-tunables-vulnerability-exploited-by-kinsing/)

---
Source page: https://erroneo.us/security/briefs/looney-tunables-glibc-ld-so-cve-2023-4911/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt