First published: Wed May 17 2023(Updated: )
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of vmw_buffer_object objects. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.
Affected Software | Affected Version | How to fix |
---|---|---|
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this Linux Kernel vulnerability is ZDI-CAN-20292.
The severity of the ZDI-CAN-20292 vulnerability is high.
The ZDI-CAN-20292 vulnerability allows local attackers to escalate privileges by exploiting a double free vulnerability in the vmwgfx driver.
To fix the ZDI-CAN-20292 vulnerability, users should apply the patch provided by the Linux Kernel development team.
You can find more information about the ZDI-CAN-20292 vulnerability on the Zero Day Initiative website and the Linux Kernel Git repository.