| Package | Affected versions | Patched versions |
|---|---|---|
| codeready linux builder | = 8.0= 9.0 | |
| codeready linux builder eus | = 8.8= 9.2= 9.4 | |
| codeready linux builder for arm64 | = 8.0_aarch64= 9.0_aarch64 | |
| codeready linux builder for arm64 eus | = 8.8_aarch64= 9.2_aarch64= 9.4_aarch64 | |
| codeready linux builder for ibm z systems | = 9.0_s390x | |
| codeready linux builder for ibm z systems eus | = 9.2_s390x= 9.4_s390x | |
| codeready linux builder for power little endian | = 8.0_ppc64le= 9.0_ppc64le | |
| codeready linux builder for power little endian eus | = 8.8_ppc64le= 9.2_ppc64le= 9.4_ppc64le |
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free