Security readout for executives and security teams
Plain-English summary
CVE-2023-33951 is a Linux kernel information disclosure flaw in the vmwgfx driver. An attacker already holding high local privileges could exploit a race condition to expose kernel-context information. Business urgency is moderate: it is serious on affected Red Hat systems, but the cited evidence requires local privileged access and does not show active exploitation.
Executive priority
Treat this as a scheduled security update with focused priority for affected RHEL 8 and 9 systems. It does not justify emergency response based on the provided evidence, but kernel information disclosure can support later attacks if privileged access is already present.
Technical view
The flaw is improper locking during GEM object handling in the Linux kernel vmwgfx driver, classified as CWE-413. The CVSS 3.1 score is 6.7 with local attack vector, low complexity, high privileges required, changed scope, high confidentiality impact, no integrity impact, and low availability impact.
Likely exposure
Exposure is most likely on Red Hat Enterprise Linux 8, RHEL 8.8 EUS, RHEL 9, and RHEL 9.2 EUS systems running affected kernel or kernel-rt packages listed in the source bundle. RHEL 6 and RHEL 7 are listed as unaffected. Other distributions are not assessed in the provided evidence.
Exploitation context
The bundle does not cite CISA KEV listing or active exploitation. Public evidence describes local privileged exploitation potential, not remote compromise. The practical risk is higher where untrusted administrators, delegated privileged users, or compromised privileged accounts exist on affected systems.
Researcher notes
Key constraints are local access and high privileges. The vulnerability centers on vmwgfx GEM object locking. The source bundle names Red Hat package versions and advisories but does not provide exploit details, active exploitation evidence, or a standalone mitigation beyond vendor errata tracking.
Mitigation direction
- Apply the relevant Red Hat security errata for affected kernel or kernel-rt packages.
- Prioritize internet-facing virtualization hosts and shared systems with delegated privileged access.
- If patching is delayed, check Red Hat guidance for supported mitigations or workarounds.
- Reboot or otherwise activate the updated kernel according to normal change procedures.
- Track exceptions for systems remaining on affected EUS kernel streams.
Validation and detection
- Inventory RHEL versions and kernel or kernel-rt package builds against the affected list.
- Confirm whether the running kernel has been updated, not only the installed package.
- Review whether vmwgfx exposure is relevant on each affected system class.
- Check vulnerability scanner findings against Red Hat CVE and errata data.
- Document RHEL 6 and RHEL 7 systems as unaffected only if package evidence matches.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-413: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-33951 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L1.54.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.7MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2023:6583CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:6901CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7077CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1404CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4823CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4831CVE reference · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-33951CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2218195CVE reference · issue-tracking, x_refsource_REDHAT
- https://www.zerodayinitiative.com/advisories/ZDI-CAN-20110/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Resource Locking
Improper Resource Locking represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.