Linux vmwgfx Kernel Race Condition Local Privileged Info Disclosure
CVE-2023-33951 Published on July 24, 2023

Kernel: vmwgfx: race condition leading to information disclosure vulnerability
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2023-33951 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a small impact on availability.

Exploitation:
NONE
Automatable:
NO
Technical Impact:
PARTIAL
Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
LOW

Timeline

Reported to Red Hat.

Made public.

Weakness Type

Improper Resource Locking

The software does not lock or does not correctly lock a resource when the software must have exclusive access to the resource. When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the software. This might violate the software's assumption that the resource will not change, potentially leading to unexpected behaviors.


Products Associated with CVE-2023-33951

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-33951 are published in these products:

Linux Kernel
Red Hat Enterprise Linux (RHEL)
Red Hat Enterprise Linux For Real Time
Red Hat Enterprise Linux Real Time Nfv
Red Hat Rhel Eus
Red Hat Rhel Els

Affected Versions

Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.8 Extended Update Support: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.2 Extended Update Support: Red Hat Enterprise Linux 9.2 Extended Update Support: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 9:

Exploit Probability

EPSS
0.34%
Percentile
28.00%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.