Looney Tunables

CVE-2023-4911

Theory

CVE-2023-4911 (Looney Tunables) is a buffer overflow vulnerability in GNU C Library’s dynamic loader’s, known as ld.so, when processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

This vulnerability was introduced in glibc version 2.34 through commit 2ed18c. The vulnerability affects recent versions of major Linux distributions such as RHEL, Ubuntu, Fedora , Debian, Amazon Linux, Gentoo and any other distribution that uses glibc.

The vulnerability impacts major Linux distributions, including:

• Fedora 37 and 38

• Ubuntu 22.04 and 23.04

• Debian 12 and 13

Practice

Enumerate

To test directly whether the target is vulnerable, we can use the following command (vulnerable if there is a segmentation error):

$ env -i "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=`printf '%08192x' 1`" /usr/bin/su --help
Segmentation fault (core dumped)

If glibc version is greater or equal than 2.34, target may be vulnerable

$ ldd --version
ldd (Ubuntu GLIBC 2.27-3ubuntu1.6) 2.27
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Or we can retreive the version of glibc using the following C++ code

glibc.cpp

#include <stdio.h>
#include <stdlib.h>
#include <gnu/libc-version.h>

int main(int argc, char *argv[])
{
    // Print glibc version
    printf("GNU libc version: %s\n", gnu_get_libc_version());
    exit(EXIT_SUCCESS);
}

Compile the above code using the following command:

g++ -std=c++11 glibc.c -o glibc

And execute it

./glibc
GNU libc version: 2.31

Exploit - 1

Exploit - 2

Resources

https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txtwww.qualys.com

Looney TunablesTryHackMe

CVE-2023-4911: Local Privilege Escalation in glibc’s ld.so | QualysQualys