PT-2023-24107 · Unknown+2 · Accountsservice+2

Kevin Backhouse · Published 2023-06-28 · Updated 2023-09-25 · CVE-2023-3297

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions accountsservice (affected versions not specified)

Description An unprivileged local attacker can trigger a use-after-free issue in accountsservice by sending a D-Bus message to the accounts-daemon process. This allows the attacker to potentially exploit the vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

AZL-43453

AZL-44259

CVE-2023-3297

USN-6190-1

USN-6190-2

Affected Products

Linuxmint

Ubuntu

Accountsservice

References · 17

• 🔥 https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182 · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice · Exploit
• https://ubuntu.com/security/notices/USN-6190-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3297 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3297 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3297 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43453 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-3297 · Security Note
• https://osv.dev/vulnerability/USN-6190-2 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44259 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6190-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6190-1 · Vendor Advisory
• https://twitter.com/reverseame/status/1700221972955762805 · Twitter Post
• https://twitter.com/cracbot/status/1697851904381026448 · Twitter Post