Report

glibc CVE-2023-4911 Looney Tunables Buffer Overflow

7e98e6bc-f356-4c10-9a5f-db5e8d057731

Heap buffer overflow in glibc-2.37 dynamic linker when processing GLIBC_TUNABLES environment variable in AT_SECURE mode. The parse_tunables function rebuilds the tunable string in-place to filter unsafe tunables, but writes full tunable names without bounds checking, causing overflow when names are longer than original input.