Bug 2245663 (CVE-2023-5633) - CVE-2023-5633 kernel: vmwgfx: reference count issue leads to use-after-free in surface handling
Summary: CVE-2023-5633 kernel: vmwgfx: reference count issue leads to use-after-free i...
Keywords:
Status: NEW
Alias: CVE-2023-5633
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2245668
Blocks: 2245660
TreeView+ depends on / blocked
 
Reported: 2023-10-23 13:51 UTC by Mauro Matteo Cascella
Modified: 2024-04-17 19:06 UTC (History)
46 users (show)

Fixed In Version: kernel 6.6-rc6
Doc Type: If docs needed, set a value
Doc Text:
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:0610 0 None None None 2024-01-30 14:48:50 UTC
Red Hat Product Errata RHBA-2024:0611 0 None None None 2024-01-30 14:53:15 UTC
Red Hat Product Errata RHBA-2024:0620 0 None None None 2024-01-30 17:09:51 UTC
Red Hat Product Errata RHBA-2024:0636 0 None None None 2024-01-31 18:06:03 UTC
Red Hat Product Errata RHSA-2024:0113 0 None None None 2024-01-10 10:42:55 UTC
Red Hat Product Errata RHSA-2024:0134 0 None None None 2024-01-10 10:46:30 UTC
Red Hat Product Errata RHSA-2024:0461 0 None None None 2024-01-24 16:29:19 UTC
Red Hat Product Errata RHSA-2024:1404 0 None None None 2024-03-19 17:27:37 UTC

Description Mauro Matteo Cascella 2023-10-23 13:51:37 UTC 
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

Upstream patch & commit:
https://lists.freedesktop.org/archives/dri-devel/2023-September/424805.html
https://github.com/torvalds/linux/commit/91398b413d03660fd5828f7b4abc64e884b98069
Comment 1 Mauro Matteo Cascella 2023-10-23 14:37:57 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2245668]
Comment 4 Justin M. Forbes 2023-10-23 17:20:24 UTC 
This is fixed for Fedora with the 6.5.8 stable kernel update.
Comment 23 errata-xmlrpc 2024-01-10 10:42:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0113 https://access.redhat.com/errata/RHSA-2024:0113
Comment 24 errata-xmlrpc 2024-01-10 10:46:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0134 https://access.redhat.com/errata/RHSA-2024:0134
Comment 25 errata-xmlrpc 2024-01-24 16:29:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:0461 https://access.redhat.com/errata/RHSA-2024:0461
Comment 26 errata-xmlrpc 2024-03-19 17:27:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:1404
Note You need to log in before you can comment on or make changes to this bug.