Looney Tunables (CVE-2023-4911).

A buffer overflow in glibc's dynamic loader triggered by the GLIBC_TUNABLES environment variable that yields local root on many Linux distributions. It belongs to the Vulnerabilities category of cybersecurity.

A buffer overflow in glibc's dynamic loader triggered by the GLIBC_TUNABLES environment variable that yields local root on many Linux distributions.

Looney Tunables is a vulnerability in the GNU C Library (glibc) dynamic loader ld.so disclosed by Qualys in October 2023 and tracked as CVE-2023-4911. It is a buffer overflow in parsing the GLIBC_TUNABLES environment variable, introduced in glibc 2.34. Because ld.so runs with elevated privileges when launching SUID binaries, an unprivileged local attacker can craft a malicious GLIBC_TUNABLES value, execute any SUID program (such as su), and gain root. Affected systems include default installations of Fedora 37/38, Ubuntu 22.04/23.04 and Debian 12 and 13. Mitigation is upgrading glibc to a patched version.

Defences for Looney Tunables (CVE-2023-4911) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CVE-2023-4911, GLIBC_TUNABLES overflow.