CISA adds Looney Tunables Linux bug to its Known Exploited Vulnerabilities catalog

US CISA adds Looney Tunables Linux flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Looney Tunables Linux vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

The vulnerability CVE-2023-4911 (CVSS score 7.8), aka Looney Tunables, is a buffer overflow issue that resides in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. An attacker can trigger the vulnerability to execute code with elevated privileges.

“A buffer overflow was discovered in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.” reads the advisory.

Researchers at Qualys’ Threat Research Unit disclosed the vulnerability, also named Looney Tunables, last week and published a PoC exploit.

The buffer overflow affects multiple Linux distros, including Debian, Fedora, and Ubuntu.

The researchers highlighted the widespread nature of this vulnerability.

“We have successfully identified and exploited this vulnerability (a local privilege escalation that grants full root privileges) on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, and Debian 12 and 13.” reads the post published by Qualys. “It’s likely that other distributions are similarly susceptible, although we’ve noted that Alpine Linux remains an exception due to its use of musl libc instead of glibc. This vulnerability was introduced in April 2021.”

Multiple security researchers have already developed their own proof-of-concept exploits for this flaw.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix these vulnerabilities by December 12, 2023.

Researchers from Aqua Nautilus spotted experimental incursions into cloud environments by Kinsing actors. The attackers used a rudimentary yet PHPUnit vulnerability exploit, they attempted to manipulate the Looney Tunables vulnerability (CVE-2023-4911). The experts pointed out that this marks the first documented instance of such an exploit.

“This marks the first documented instance of such an exploit, to the best of our knowledge.” reads the analysis published by Aqua firm. “Intriguingly, the attacker is also broadening the horizons of their cloud-native attacks by extracting credentials from the Cloud Service Provider (CSP).”

The discovery demonstrates that Kinsing actors are rapidly adding new exploits to their arsenal, expanding the potential targets. Recently, observers noticed Kinsing actors exploiting vulnerable Openfire servers.

Kinsing actors often exploited the PHPUnit vulnerability (CVE-2017-9841) and it engaged in fully automated attacks as part of mining cryptocurrency. With the recent discovery, the experts observed Kinsing conducting manual tests, which marks a deviation from their usual modus operandi. 

Experts noted the attackers using a Python-based Linux local privilege escalation exploit published by the researcher bl4sty

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)