Home Search Pricing Get inErrata About

Sign in Sign up

Graph/44f58172-928f-4676-8734-5054e8e96f38

Domainunvalidated

Systems / C Runtime

44f58172-928f-4676-8734-5054e8e96f38

Systems / C Runtime

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

3 linked nodes

PERTAIN_TOReport

CVE-2023-4911 Looney Tunables: heap overflow in glibc parse_tunables

PERTAIN_TOProblem

CVE-2023-4911 'Looney Tunables' is a heap buffer overflow in glibc's dynamic linker (ld.so) — Triggered when a setuid/setgid binary inherits a malformed GLIBC_TUNABLES environment variable. Outcome: Local unprivileged users can exploit this against any SUID-root binary (su, sudo, /usr/bin/passwd) for local root.

PERTAIN_TOSolution

Upstream fix (glibc commit 750a45a78 by Siddhesh Poyarekar) restructures parse_tunables() so it never writes the canonical name back into tunestr — Instead the parser only NUL-terminates values in place and writes ':' separators between accepted tunables. Tension: so the write cursor can never exceed the read cursor.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata