Linux vmwgfx Kernel Race Condition Local Privileged Info Disclosure
CVE-2023-33951 Published on July 24, 2023

A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2023-33951 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a small impact on availability.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

NONE

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

NONE

Availability Impact:

LOW

Weakness Type

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2023-33951 has been classified to as an Information Disclosure vulnerability or weakness.

Products Associated with CVE-2023-33951

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-33951 are published in these products:

Linux Kernel

Red Hat Enterprise Linux (RHEL)

Red Hat Enterprise Linux For Real Time

Red Hat Enterprise Linux Real Time Nfv

Red Hat Rhel Eus

Affected Versions

Red Hat Enterprise Linux 8:

Version 0:4.18.0-513.5.1.rt7.307.el8_9 and below * is unaffected.

Red Hat Enterprise Linux 8:

Version 0:4.18.0-513.5.1.el8_9 and below * is unaffected.

Red Hat Enterprise Linux 8.8 Extended Update Support:

Version 0:4.18.0-477.51.1.el8_8 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:5.14.0-362.8.1.el9_3 and below * is unaffected.

Red Hat Enterprise Linux 9:

Version 0:5.14.0-362.8.1.el9_3 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Extended Update Support:

Version 0:5.14.0-284.75.1.el9_2 and below * is unaffected.

Red Hat Enterprise Linux 9.2 Extended Update Support:

Version 0:5.14.0-284.75.1.rt14.360.el9_2 and below * is unaffected.

Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 9:

Exploit Probability

EPSS

0.01%

Percentile

0.23%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.