The vulnerability is identified as CVE-2023-4911 and has a CVSS score of 7.8 (High). According to Picus Security, it was introduced with glibc 2.34 in April 2021.
The vulnerability allows an attacker to gain full root-level privileges in vulnerable Linux systems.
Qualys found that it is caused by a buffer overflow in the GNU C Library’s dynamic loader ld.so while it processes the GLIBC_TUNABLES environment variable.
The loader is responsible for loading shared libraries into memory at program startup and linking them to the program.
Qualys exploited it on default installations of Fedora, Ubuntu, and Debian, and other distributions are likely affected. Organizations are advised to update their vulnerable Linux systems as soon as possible.