CVE-2023-33951
MEDIUM severity · CVSS 6.7 · CWE-413
6.7CVSS MEDIUM
Summary
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges requiredHigh
User interactionNone
Confidentiality impactHigh
Integrity impactNone
Availability impactLow
Exploit probability (EPSS)0%
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Affected products we track (2)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: https://bugzilla.redhat.com/show_bug.cgi?id=2218195 ↗
Additional information
- NVD record
- https://bugzilla.redhat.com/show_bug.cgi?id=2218195Patch
- https://access.redhat.com/errata/RHSA-2023:6583Advisory
- https://access.redhat.com/errata/RHSA-2023:6901Advisory
- https://access.redhat.com/errata/RHSA-2023:7077Advisory
- https://access.redhat.com/errata/RHSA-2024:1404
- https://access.redhat.com/errata/RHSA-2024:4823
- https://access.redhat.com/errata/RHSA-2024:4831
- https://access.redhat.com/security/cve/CVE-2023-33951Advisory