CVE-2023-20865
published 2023-04-20CVE-2023-20865: VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs…
PriorityP350high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.70%
74.7th percentile
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | aria_operations_for_logs | >= 8.6.0 < 8.12.0 | 8.12.0 |
| vmware | cloud_foundation | 4.0 – 4.5 | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: media: v4l2-mem2mem: add lock to protect parameter num_rdy
vendor_redhat·2025-10-01·CVSS 5.5
CVE-2023-53519 [MEDIUM] CWE-820 kernel: media: v4l2-mem2mem: add lock to protect parameter num_rdy
kernel: media: v4l2-mem2mem: add lock to protect parameter num_rdy
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-mem2mem: add lock to protect parameter num_rdy
Getting below error when using KCSAN to check the driver. Adding lock to
protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.
kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue
kworker/u16:3: [name:report&]
kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux
VMware
VMware Aria Operations for Logs (Operations for Logs) update addresses multiple vulnerabilities. (CVE-2023-20864, CVE-2023-20865)
vendor_vmware·2023-04-20·CVSS 9.8
CVE-2023-20864 [CRITICAL] VMware Aria Operations for Logs (Operations for Logs) update addresses multiple vulnerabilities. (CVE-2023-20864, CVE-2023-20865)
VMSA-2023-0007: VMware Aria Operations for Logs (Operations for Logs) update addresses multiple vulnerabilities. (CVE-2023-20864, CVE-2023-20865)
VMware Aria Operations for Logs contains a deserialization vulnerability. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CVEs: CVE-2023-20864, CVE-2023-20865
Affected products: VMware Aria, VMware Cloud Foundation
GHSA
GHSA-3frw-92jp-g6w8: VMware Aria Operations for Logs contains a command injection vulnerability
ghsa_unreviewed·2023-04-20
CVE-2023-20865 [HIGH] CWE-77 GHSA-3frw-92jp-g6w8: VMware Aria Operations for Logs contains a command injection vulnerability
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.
No detection rules found.
No public exploits indexed.
Tenable
CVE-2023-20864: VMware Aria Operations for Logs Deserialization Vulnerability
blogs_tenable·2023-04-21·CVSS 9.8
[CRITICAL] CVE-2023-20864: VMware Aria Operations for Logs Deserialization Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2023-53519 kernel: media: v4l2-mem2mem: add lock to protect parameter num_rdy
bugzilla·2025-10-01·CVSS 5.5
CVE-2023-53519 [MEDIUM] CVE-2023-53519 kernel: media: v4l2-mem2mem: add lock to protect parameter num_rdy
CVE-2023-53519 kernel: media: v4l2-mem2mem: add lock to protect parameter num_rdy
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-mem2mem: add lock to protect parameter num_rdy
Getting below error when using KCSAN to check the driver. Adding lock to
protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.
kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue
kworker/u16:3: [name:report&]
kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025100132-CVE-2023-53519-de9d@gregkh/T
2023-04-20
Published