PT-2023-24107 · Unknown+2 · Accountsservice+2

Kevin Backhouse · Publicado 2023-06-28 · Atualizado 2023-09-25 · CVE-2023-3297

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions accountsservice (affected versions not specified)

Description An unprivileged local attacker can trigger a use-after-free issue in accountsservice by sending a D-Bus message to the accounts-daemon process. This allows the attacker to potentially exploit the vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

AZL-43453

AZL-44259

CVE-2023-3297

USN-6190-1

USN-6190-2

Produtos afetados

Linuxmint

Ubuntu

Accountsservice

Referências · 17

• 🔥 https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182 · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice · Exploit
• https://twitter.com/reverseame/status/1700221972955762805 · Publicação no Twitter
• https://ubuntu.com/security/notices/USN-6190-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3297 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-3297 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3297 · Nota de Segurança
• https://twitter.com/cracbot/status/1697851904381026448 · Publicação no Twitter
• https://t.me/cibsecurity/69696 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3297 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-43453 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297 · Nota
• https://cve.org/CVERecord?id=CVE-2023-3297 · Nota de Segurança
• https://osv.dev/vulnerability/USN-6190-2 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-44259 · Aviso do Fabricante