{"id":"CVE-2023-5633","title":"Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling","summary":"The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-911"],"vendor":"Red Hat","product":"kernel-rt","affected":["kernel-rt (all versions)","kernel (all versions)","kernel (all versions)","kernel (all versions)","kernel (all versions)","kernel (all versions)","kernel-rt (all versions)","kernel","kernel","kernel-rt","kernel-rt (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2024-05-10T04:00:11.958257Z"},"published":"2023-10-23","updated":"2026-11-04","sourceUpdated":"2026-11-04T21:06:09.699Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-5633","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:0113","label":"RHSA-2024:0113"},{"url":"https://access.redhat.com/errata/RHSA-2024:0134","label":"RHSA-2024:0134"},{"url":"https://access.redhat.com/errata/RHSA-2024:0461","label":"RHSA-2024:0461"},{"url":"https://access.redhat.com/errata/RHSA-2024:1404","label":"RHSA-2024:1404"},{"url":"https://access.redhat.com/errata/RHSA-2024:4823","label":"RHSA-2024:4823"},{"url":"https://access.redhat.com/errata/RHSA-2024:4831","label":"RHSA-2024:4831"},{"url":"https://access.redhat.com/security/cve/CVE-2023-5633"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245663","label":"RHBZ#2245663"}],"tags":["cve.org"],"epss":0.00278,"epssPercentile":0.20375,"ingestedAt":"2026-11-05T21:36:00.591Z","slug":"CVE-2023-5633","body":"## Overview\n\nThe reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.\n\n## Affected\n\n- `kernel-rt (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel-rt (all versions)`\n- `kernel`\n- `kernel`\n- `kernel-rt`\n- `kernel-rt (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThis flaw can be mitigated by turning off 3D acceleration in VMware (if possible) or preventing the affected `vmwgfx` kernel module from being loaded. For instructions on how to blacklist a kernel module, please see https://access.redhat.com/solutions/41278.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}