CVE-2023-5633

HighCVSS 7.8/10Last modified Nov 4, 2026

Description

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-911 CWE-416

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	—
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 9	—

References

https://access.redhat.com/errata/RHSA-2024:0113Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0134Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0461Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1404Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4823Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4831Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-5633Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2245663Issue Tracking, Patch
https://access.redhat.com/errata/RHSA-2024:0113Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0134Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0461Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:1404Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4823Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4831Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-5633Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2245663Issue Tracking, Patch

Timeline

Published: Oct 23, 2023
Last modified: Nov 4, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-56349.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL CVE-2023-56357.5Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. CVE-2023-56369.8Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection. This issue affects E CVE-2023-56377.5Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executa CVE-2023-56385.4The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcj_image' shortcode in versions up to, a CVE-2023-56395.4The Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tmfshortcode' shortcode in all version CVE-2023-56409.8The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX acti CVE-2023-56416.1The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before ou CVE-2023-56429.8Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitiv CVE-2023-56437.8Out-of-bounds Write vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architect CVE-2023-56447.6The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role CVE-2023-56458.8The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading