CVE-2023-33951: Kernel: vmwgfx: race condition leading to information disclosure vulnerability

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-24 · updated 2026-06-17
Weakness: CWE-413

Description

A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to disclose information in the context of the kernel.

Affected products

Linux kernel: through 6.3.9
Red Hat Enterprise Linux: 8.0, 9.0
RedHat Enterprise Linux For Real Time: 8.0
RedHat Enterprise Linux For Real Time For Nfv: 8.0

References

https://access.redhat.com/errata/RHSA-2023:6583
https://access.redhat.com/errata/RHSA-2023:6901
https://access.redhat.com/errata/RHSA-2023:7077
https://access.redhat.com/errata/RHSA-2024:1404
https://access.redhat.com/errata/RHSA-2024:4823
https://access.redhat.com/errata/RHSA-2024:4831
https://access.redhat.com/security/cve/CVE-2023-33951
https://bugzilla.redhat.com/show_bug.cgi?id=2218195
https://www.zerodayinitiative.com/advisories/ZDI-CAN-20110/
https://access.redhat.com/errata/RHSA-2023:6583
https://access.redhat.com/errata/RHSA-2023:6901
https://access.redhat.com/errata/RHSA-2023:7077

Get alerted when CVE-2023-33951 or the next vulnerability affects your stack