CVE-2023-33952

NameCVE-2023-33952
DescriptionA double-free vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of vmw_buffer_object objects. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. This flaw allows a local privileged user to escalate privileges and execute code in the context of the kernel.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)buster4.19.249-2fixed
buster (security)4.19.289-2fixed
bullseye5.10.178-3fixed
bullseye (security)5.10.191-1fixed
bookworm6.1.38-1fixed
bookworm (security)6.1.52-1fixed
trixie6.4.13-1fixed
sid6.5.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcebuster(not affected)
linuxsourcebullseye(not affected)
linuxsource(unstable)6.1.15-1

Notes

[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
https://www.zerodayinitiative.com/advisories/ZDI-CAN-20292/
https://git.kernel.org/linus/9ef8d83e8e25d5f1811b3a38eb1484f85f64296c (6.4-rc1)

Search for package or bug name: Reporting problems