CVE-2023-33952

A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2023:6583	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6901	Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7077	Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1404
https://access.redhat.com/errata/RHSA-2024:4823
https://access.redhat.com/errata/RHSA-2024:4831
https://access.redhat.com/security/cve/CVE-2023-33952	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2218212	Issue Tracking Patch Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-CAN-20292	Patch Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_real_time:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8.0:::::::*

History

No history.

Information

Published : 2023-07-24 16:15

Updated : 2024-07-24 16:15

NVD link : CVE-2023-33952

Mitre link : CVE-2023-33952

CVE.ORG link : CVE-2023-33952

JSON object : View

Products Affected

redhat

enterprise_linux
enterprise_linux_for_real_time
enterprise_linux_for_real_time_for_nfv

linux

linux_kernel

CWE

CWE-415

Double Free

{"id": "CVE-2023-33952", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2023-07-24T16:15:11.893", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:6583", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:6901", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7077", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:1404", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4823", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2024:4831", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-33952", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218212", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-CAN-20292", "tags": ["Patch", "Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-415"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-415"}]}], "descriptions": [{"lang": "en", "value": "A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de double free en el manejo de objetos vmw_buffer_object en el controlador vmwgfx en el kernel de Linux. Este problema se produce debido a la falta de validaci\u00f3n de la existencia de un objeto antes de realizar m\u00e1s operaciones libres en el objeto, lo que puede permitir a un usuario privilegiado local escalar privilegios y ejecutar c\u00f3digo en el contexto del kernel."}], "lastModified": "2024-07-24T16:15:05.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91F73DF0-B48A-4A70-A0C6-8844D289441D", "versionEndIncluding": "6.3.9"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_real_time:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5487EF77-D23A-4CC0-851C-E330B4485D8A"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "782C86CD-1B68-410A-A096-E5170AD24DA2"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}