Vulnerability · Published Jul 24, 2023 · Assigned by redhat
CVE-2023-33952Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
Medium 6.7
In plain English
A medium-severity double free in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.7Medium
Exploit odds (30 days)0.5%top 59.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-abi-stablelists | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-core | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-cross-headers | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-debug | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-debug-core | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-debug-devel | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-debug-modules | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-debug-modules-extra | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-devel | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-doc | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-headers | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-modules | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-modules-extra | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-tools | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-tools-libs | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-zfcpdump | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-zfcpdump-core | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-zfcpdump-devel | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-zfcpdump-modules | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | kernel-zfcpdump-modules-extra | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | perf | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| AlmaLinux:8 | python3-perf | 4.18.0-513.5.1.el8_9 | ALSA-2023:7077 |
| Debian:12 | linux | 6.1.15-1 | DEBIAN-CVE-2023-33952 |
| Debian:13 | linux | 6.1.15-1 | DEBIAN-CVE-2023-33952 |
| Debian:14 | linux | 6.1.15-1 | DEBIAN-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | 5.19.0-1012.12~22.04.1 | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | 5.19.0-1025.26~22.04.1 | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | 5.19.0-1024.26~22.04.1 | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | 5.19.0-42.43~22.04.1 | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | 5.19.0-1024.25~22.04.1 | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | 6.1.0-1008.8 | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | 5.19.0-1018.19~22.04.1 | UBUNTU-CVE-2023-33952 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | 5.19.0-1017.19~22.04.1 | UBUNTU-CVE-2023-33952 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-415 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2023:6583 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:6901 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7077 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1404 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4823 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4831 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-33952 vdb-entry, x_refsource_REDHAT
- RHBZ#2218212 issue-tracking, x_refsource_REDHAT
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-20292