glibc - Local Privilege Escalation (CVE-2023-4911)

[ccto]

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

F.Y.I. -
https://access.redhat.com/security/cve/cve-2023-4911
https://blog.qualys.com/vulnerabili...ocal-privilege-escalation-in-the-glibcs-ld-so

There are glibc update in AL8 and AL9 (glibc update needs reboot).

 

[Erulezz]

Thanks for the heads up Curl CVE also incoming soon

 

[ccto]

i.e. incoming rpm updates: libspf2 , curl

 

[Erulezz]

And kernel updates.. busy times

 

[LawsHosting]

Thank god I'm done with all this faff-faff-faffing-ing-ing about

 

[ccto]

cURL: https://curl.se/docs/CVE-2023-38545.html

It shall affect EL9 only (if I am right )
EL9: cURL 7.76
EL8: cURL 7.61
EL7: cURL 7.29