CVE-2023-33952

MediumCVSS 6.7/10Last modified Nov 6, 2026

Description

A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-415

Affected software

VendorProductVersions
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 9—

References

Timeline

Published
Jul 24, 2023
Last modified
Nov 6, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-339537.5gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exCVE-2023-339555.3Minio Console is the UI for MinIO Object Storage. Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. This CVE-2023-339566.5Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an InsecCVE-2023-339575.7notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high nuCVE-2023-339586.5notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high nuCVE-2023-339598.8notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to CVE-2023-33966.5A vulnerability was found in Campcodes Retro Cellphone Online Store 1.0. It has been declared as critical. Affected by this vulnerability isCVE-2023-339607.5OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server CVE-2023-339615.4Leantime is a lean open source project management system. Starting in version 2.3.21, an authenticated user with commenting privileges can iCVE-2023-339626.1JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes `'` in HTML, allowiCVE-2023-339639.8DataEase is an open source data visualization and analysis tool. Prior to version 1.18.7, a deserialization vulnerability exists in the DataCVE-2023-339647.5mx-chain-go is an implementation of the MultiversX blockchain protocol written in the Go language. Metachain cannot process a cross-shard mi