Researchers have discovered a significant cybersecurity threat, nicknamed “Looney Tunables,” with tracking code CVE-2023-4911, that impacts multiple versions of major Linux distributions, including Debian versions 12 and 13, Ubuntu versions 22.04 and 23.04, and Fedora versions 37 and 38. This high-severity flaw originates from a buffer overflow weakness in the GNU C Library‘s dynamic loader.
The imperfection can be exploited to gain root access rights, thereby allowing any potential attacker arbitrary code execution when launching binaries with SUID permission. A maliciously designed GLIBC_TUNABLES environment variable processed by the ld.so dynamic loader is all that is needed to trigger this potential exploit.
Researchers Release Proof-of-concept Exploits
Despite the disclosure made on this crucial flaw by Qualys' Threat Research Unit last Tuesday, several security researchers have released proof-of-concept (PoC) exploits for certain system configurations, raising major security concerns. One of these PoC exploits, verified as operational by vulnerability and exploit expert Will Dormann, was released today by independent security researcher Peter Geissler, also known as “blasty”. Even though this exploit seems limited to specific targets, Geissler's PoC provides instructions on additional target identifications through offsets in each system's ld.so dynamic loader.
Yeah, this works. https://t.co/EQWH04G2eM pic.twitter.com/AY8eWMMIsp
— Will Dormann (@wdormann) October 5, 2023
Other researchers are reportedly rapidly developing and releasing their own CVE-2023-4911 exploits on platforms like GitHub, although the functionality of these exploits remains to be confirmed.
Urge for Prompt Actions
Considering the gravity of the situation, administrators have been urged to act promptly due to the threat this security flaw poses. It's pertinent to note that complete root access is granted to these systems, including those running the latest releases of Fedora, Ubuntu, and Debian. Alpine Linux admins, a distro unaffected by this vulnerability, can rest easy, while admins from other affected systems should prioritize patching to ensure system integrity and security are upheld.
Saeed Abbasi, Product Manager at Qualys' Threat Research Unit, warned of the severity and widespread nature of the vulnerability, stressing the urgency of the situation. He cautioned that due to the ease of transforming the buffer overflow into a data-only attack, other research teams could potentially release exploits, putting countless systems at risk.
Last Updated on October 12, 2023 10:47 am CEST by Markus Kasanmascheff
