CVE-2023-5633

CWE-911CWE-416 — Use After Free11 documents8 sources
Severity
7.8HIGH
EPSS
0.0%
top 97.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
22
Linux Linux KernelRedhat Codeready Linux BuilderRedhat Codeready Linux Builder EUS+19 more
Timeline
PublishedOct 23
Latest updateMar 11

Description

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDlinux/linux_kernel6.1.13 — 6.1.75+2
▶Debianlinux< 6.1.76-1+2

Also affects: Enterprise Linux 8.0, 9.0, 8.8, 9.2, 9.4

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-3hmc-jxr7-rw7j: The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were h↗2023-10-24
▶
OSV
CVE-2023-5633: The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were h↗2023-10-23
▶
CVEList
Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling↗2023-10-23
▶

📋Vendor Advisories

7
Ubuntu
Linux kernel (OEM) vulnerabilities↗2024-03-11
▶
Ubuntu
Linux kernel (Azure) vulnerabilities↗2024-01-09
▶
Ubuntu
Linux kernel (GCP) vulnerabilities↗2023-12-06
▶
Ubuntu
Linux kernel vulnerabilities↗2023-11-21
▶
Microsoft
Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling↗2023-10-10
▶