CVE-2023-33952

2023-06-2813:17:14

redhat.com

access.redhat.com

cve-2023-33952

vmw_buffer_object

privilege escalation

linux kernel

vmwgfx driver

local user

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

15.9%

JSON

A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.

Mitigation

This flaw can be mitigated by preventing the affected vmwgfx kernel module from being loaded. For instructions on how to blacklist a kernel module, please see <https://access.redhat.com/solutions/41278>.