CVE-2023-4911 "Looney Tunables" Analysis Environment

Docker-based practice environment for analyzing and developing exploits for the GNU C Library (glibc) dynamic loader buffer overflow vulnerability (Local Privilege Escalation).

CVE Information

Vulnerability Mechanism

The glibc dynamic loader (ld.so) parses the GLIBC_TUNABLES environment variable when a program is executed.
When a SUID binary is run, __libc_enable_secure = 1 is set, and ld.so enters a code path that nullifies the environment variable.
During this process, a buffer overflow occurs due to incorrect length calculation for input in the format tunable1=tunable2=value.

Normal binary:  __libc_enable_secure = 0  →  nullify code not entered  →  no vulnerability
SUID binary:    __libc_enable_secure = 1  →  nullify code entered     →  buffer overflow occurs

Exploit Flow:

GLIBC_TUNABLES overflow
        ↓
Overwrite link_map pointer in ld.so BSS area
        ↓
Redirect library search path to evil_lib/ directory
        ↓
evil.so loaded → constructor automatically executed
        ↓
setuid(0) + execve("/bin/bash") → root shell acquired

Environment Setup Goals and Direction

This environment is designed to go beyond simple PoC execution, aiming to directly analyze the vulnerability's working principle and develop an exploit.

• Reproduce a working environment with a vulnerable glibc version (2.35-0ubuntu3.3)
• Provide an environment where both ld.so source code and the running binary can be analyzed together
• Support dynamic analysis via GDB / gef / gdbserver
• Allow hands-on practice with the privilege escalation scenario from normal user (researcher) to root
• Fully isolate the environment using Docker so that any team member can start analysis in the same setup

Project Structure

CVE-2023-4911/
├── Dockerfile                  # Vulnerable environment image definition (Multi-stage build)
├── run.sh                      # Docker build/run management script
├── check_environment.sh        # Automatic environment validation at container startup
├── poc/
│   ├── exploit.py              # Basic PoC — crash (SIGSEGV) verification
│   ├── exploit_lpe.py          # LPE exploit — for completion after GDB analysis
│   └── evil_lib/
│       ├── evil.c              # Malicious shared library that executes root shell
│       └── Makefile
└── test_targets/
    ├── test_suid.c             # SUID test binary source
    └── test_heap.c             # Heap allocation test binary source

Requirements

• Docker
• Linux or WSL2 (Windows)

Usage

1. Build image and run container

./run.sh build && ./run.sh run

2. Enter sudo password

When the container starts, you will be prompted for the sudo password.

Password: password

3. Verify vulnerability

# Check for SIGSEGV
python3 /workspace/poc/exploit.py --check-only

# Direct trigger
GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=AAAA \
  /workspace/test_targets/test_suid

4. GDB analysis

# Direct analysis inside container
gdb -q /workspace/test_targets/test_suid

# Remote debugging (gdbserver)
# Inside container
gdbserver :1234 /workspace/test_targets/test_suid

# Local host
gdb
(gdb) target remote localhost:1234

5. Run LPE exploit

After analyzing OVERFLOW_OFFSET and TARGET_ADDR in GDB, update the values at the top of exploit_lpe.py and run it.

python3 /workspace/poc/exploit_lpe.py

run.sh options

Analysis Environment Information

Analysis Points

Static Analysis

# Vulnerable function location
/workspace/glibc-source/elf/dl-tunables.c

# Key functions
__tunables_init()   # Entry point
parse_tunables()    # Overflow occurrence point
tunables_strdup()   # Buffer allocation

Dynamic Analysis

# Trace system calls with strace
strace -e trace=mmap GLIBC_TUNABLES="..." /workspace/test_targets/test_suid

# Analyze __tunables_init with GDB
gdb /workspace/test_targets/test_suid
(gdb) break __tunables_init
(gdb) set environment GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=AAAA
(gdb) run

Warnings

This environment is intended for educational and security research purposes only.

• This environment was created for vulnerability learning and exploit development research.
• Do not use it on production systems or against unauthorized targets.
• The container runs with --privileged mode, so use it only in an isolated environment.
• Any legal responsibility arising from misuse of the code in this repository lies with the user.

References

• Qualys Security Advisory
• glibc official repository
• Ubuntu Security Notice USN-6404-1