{"id":"CVE-2023-33952","published":"2023-07-24T15:19:18Z","modified":"2026-02-25T17:20:10Z","title":"Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","tier":"tail","description":{"text":"A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which may allow a local privileged user to escalate privileges and execute code in the context of the kernel.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00465,"percentile":0.40174,"provenance":"source"},"cwes":[{"id":"CWE-415","name":"Double Free"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6583","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6901","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7077","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1404","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4823","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4831","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-33952","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218212","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-CAN-20292","tags":[]}],"priority":{"score":12.7,"factors":[{"name":"EPSS percentile","points":8.03},{"name":"CVSS severity","points":4.69}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Extended Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":["all versions"]}],"euvd":{"id":"EUVD-2023-38088","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-enterprise-linux-8-cve-2023-33951","children":[{"from":"CVE-2023-33952","to":"CVE-2023-5633","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface.","from":"CVE.org","in":"CVE-2023-5633"}]}]}}