CASCACascade Atlas

Evidence dossier

CVE-2023-4911

Glibc: buffer overflow in ld.so leading to privilege escalation

77.5–92.5Priority evidence range
As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

State
PUBLISHED
Published
Oct 3, 2023
Updated
Jul 14, 2026
Evidence coverage
85%
CISA KEVCatalog member

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

FIRST EPSS81.42%

2026-07-18 · v2026.06.15 · percentile 99.6%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment
container

CISA ADP Vulnrichment

CVEderivative copy
container

CVE Program Container

redhatoriginal assertion
container

Glibc: buffer overflow in ld.so leading to privilege escalation

siemens-SADPunknown origin
container

Container present

CISA KEVoriginal assertion
observed_exploitation

GNU C Library Buffer Overflow Vulnerability

FIRST EPSSoriginal assertion
model_probability

Probability 0.814220000000; percentile 0.995980000000

Applicability

Cited product scope

Trace impact →
Red HatRed Hat Enterprise Linux 6
[]unknown
Red HatRed Hat Enterprise Linux 7
[]unknown
Red HatRed Hat Enterprise Linux 7
[]unknown
Red HatRed Hat Enterprise Linux 8
[{"status": "unaffected", "version": "0:2.28-225.el8_8.6", "lessThan": "*", "versionType": "rpm"}]unknown
Red HatRed Hat Enterprise Linux 8
[{"status": "unaffected", "version": "0:2.28-225.el8_8.6", "lessThan": "*", "versionType": "rpm"}]unknown
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support
[{"status": "unaffected", "version": "0:2.28-189.6.el8_6", "lessThan": "*", "versionType": "rpm"}]unknown
Red HatRed Hat Enterprise Linux 9
[{"status": "unaffected", "version": "0:2.34-60.el9_2.7", "lessThan": "*", "versionType": "rpm"}]unknown
Red HatRed Hat Enterprise Linux 9
[{"status": "unaffected", "version": "0:2.34-60.el9_2.7", "lessThan": "*", "versionType": "rpm"}]unknown
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support
[{"status": "unaffected", "version": "0:2.34-28.el9_0.4", "lessThan": "*", "versionType": "rpm"}]unknown
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8
[{"status": "unaffected", "version": "0:4.5.3-202312060823_8.6", "lessThan": "*", "versionType": "rpm"}]unknown
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8
[{"status": "unaffected", "version": "0:2.28-189.6.el8_6", "lessThan": "*", "versionType": "rpm"}]unknown
Red HatRed Hat Virtualization 4 for Red Hat Enterprise Linux 8
[{"status": "unaffected", "version": "0:4.5.3-10.el8ev", "lessThan": "*", "versionType": "rpm"}]unknown
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP
[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]unknown
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP
[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]unknown
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]unknown
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]unknown
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP
[{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}]unknown
Unknown vendorUnknown product
[{"status": "affected", "version": "2.34", "lessThan": "2.39", "versionType": "custom"}]unknown
Unknown vendorUnknown product
cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*; start including 2.34; end excluding 2.39supported
Unknown vendorUnknown product
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder:9.0:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_eus:8.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.4:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_eus:9.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:9.0_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.4_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.6_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp:-:*:*:*:*:*:*:*constrained
Unknown vendorUnknown product
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.2_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.6_aarch64:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.6_s390x:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.6_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.2_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.4_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:9.6_ppc64le:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*supported
Unknown vendorUnknown product
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*; start including 3.1.5supported
Unknown vendorUnknown product
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*; start including 3.1.5supported
Unknown vendorUnknown product
cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:*:*:*:*:*:*:*:*; end excluding 1.1supported
Unknown vendorUnknown product
cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware:*:*:*:*:*:*:*:*; start including 3.1.5supported

Assessments

CVSS by origin

7.8
nvd@nist.govCVSS 3.1 · role PrimaryCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8
secalert@redhat.comCVSS 3.1 · role SecondaryCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8
redhatCVSS 3.1 · role unknownCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Limitations and unknowns

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; unresolved scope remains unknown.
  • NVD-carried upstream facts remain derivative and are not independent corroboration.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Factor D is unknown in Public Core because no accepted canonical mapping-obligation ledger is present.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.