CVE-2023-5633
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD
Description
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.
Affected (54)
Products: Linux: Linux Kernel · Redhat: Codeready Linux Builder, Codeready Linux Builder Eus, Codeready Linux Builder For Arm64, Codeready Linux Builder For Arm64 Eus, Codeready Linux Builder For Ibm Z Systems, Codeready Linux Builder For Ibm Z Systems Eus, Codeready Linux Builder For Power Little Endian, Codeready Linux Builder For Power Little Endian Eus, Enterprise Linux, Enterprise Linux Eus, Enterprise Linux For Arm 64, Enterprise Linux For Arm 64 Eus, Enterprise Linux For Ibm Z Systems, Enterprise Linux For Ibm Z Systems Eus, Enterprise Linux For Power Little Endian, Enterprise Linux For Power Little Endian Eus, Enterprise Linux For Real Time, Enterprise Linux For Real Time For Nfv, Enterprise Linux Server Aus, Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions, Enterprise Linux Server Tus
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 6.1.13 to 6.1.75 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 8.0 | |
| Version 8.8 | |
| Version 8.0_aarch64 | |
| Version 8.8_aarch64 | |
| Version 9.0_s390x | |
| Version 9.2_s390x | |
| Version 8.0_ppc64le | |
| Version 8.8_ppc64le | |
| Version 8.0 | |
| Version 8.8 | |
| Version 8.0_aarch64 | |
| Version 8.8_aarch64 | |
| Version 8.0_s390x | |
| Version 8.8_s390x | |
| Version 8.0_ppc64le | |
| Version 9.2_ppc64le | |
| Version 8.0 | |
| Version 8.0 | |
| Version 9.2 | |
| Version 8.8 | |
| Version 8.8 |
Related CWEs
CWE-416
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-911
Improper Update of Reference Count
The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.
References (16)
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatch
Timeline
No history available yet.