CVE-2023-3297

Published: Sep 1, 2023Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Affected (8)

Products: Canonical: Accountsservice, Ubuntu Linux

Canonical

2 products

Accountsservice

Ubuntu Linux

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canonical Accountsservice	Before 23.13.9-2ubuntu2

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Accountsservice	Before 22.08.8-1ubuntu7.1

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Accountsservice	Before 22.07.5-2ubuntu1.4

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Accountsservice	Before 0.6.55-0ubuntu12\~20.04.6

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 20.04
Canonical Ubuntu Linux	Version 22.04
Canonical Ubuntu Linux	Version 22.10
Canonical Ubuntu Linux	Version 23.04

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (8)

https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182

Source: security@ubuntu.com

ExploitIssue TrackingVendor Advisory

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297

Source: security@ubuntu.com

Third Party Advisory

https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/

Source: security@ubuntu.com

ExploitThird Party Advisory

https://ubuntu.com/security/notices/USN-6190-1

Source: security@ubuntu.com

Vendor Advisory

https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingVendor Advisory

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://ubuntu.com/security/notices/USN-6190-1

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.