The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unp
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | 0:4.18.0-513.11.1.rt7.313.el8_9 |
| Red Hat | Red Hat Enterprise Linux 8 | 0:4.18.0-513.11.1.el8_9 |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | 0:4.18.0-477.51.1.el8_8 |
| Red Hat | Red Hat Enterprise Linux 9 | 0:5.14.0-362.18.1.el9_3 |
| Red Hat | Red Hat Enterprise Linux 9 | 0:5.14.0-362.18.1.el9_3 |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | 0:5.14.0-284.75.1.el9_2 |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | 0:5.14.0-284.75.1.rt14.360.el9_2 |
| Red Hat | Red Hat Enterprise Linux 6 | unspecified |
| Red Hat | Red Hat Enterprise Linux 7 | unspecified |
| Red Hat | Red Hat Enterprise Linux 7 | unspecified |
| Red Hat | Red Hat Enterprise Linux 9 | unspecified |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.