CVE-2023-4911

Отчет

This vulnerability was introduced in glibc version 2.34. RHEL-8 ships glibc 2.28, which is not originally affected by this vulnerability. However, the commit that introduced this vulnerability was backported to RHEL-8.5, making this version and onward vulnerable. RHEL-8.4 and older are not affected by this vulnerability.

Меры по смягчению последствий

For customers who cannot update immediately and do not have Secure Boot feature enabled, the issue can be mitigated using the provided SystemTap script with the following steps. When enabled, any setuid program invoked with GLIBC_TUNABLES in the environment will be terminated immediately. To invoke the setuid program, users will then have to unset or clear the GLIBC_TUNABLES envvar, e.g. GLIBC_TUNABLES= sudo . Note that these mitigation steps will need to be repeated if the system is rebooted.

1. Install required systemtap packages and dependencies as per - https://access.redhat.com/solutions/5441
2. Create the following systemtap script, and name it stap_block_suid_tunables.stp:

3. Load the systemtap module into the running kernel:

4. Ensure the module is loaded:

5. Once the glibc package is updated to the version containing the fix, the systemtap generated kernel module can be removed by running:

If Secure Boot is enabled on a system, the SystemTap module must be signed. An external compiling server can be used to sign the generated kernel module with a key enrolled into the kernel's keyring or starting with SystemTap 4.7 you can sign a module without a compile server. See further information here - https://www.redhat.com/sysadmin/secure-boot-systemtap