CVE-2023-3297

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
canonicalCNA
8.1 HIGH
LOCAL
HIGH
NONE
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
VendorProductVersion
canonicalaccountsservice
𝑥
< 23.13.9-2ubuntu2
canonicalaccountsservice
𝑥
< 22.08.8-1ubuntu7.1
canonicalaccountsservice
𝑥
< 22.08.8-1ubuntu7.1
canonicalaccountsservice
𝑥
< 22.07.5-2ubuntu1.4
canonicalubuntu_linux
20.04
canonicalubuntu_linux
22.04
canonicalubuntu_linux
22.10
canonicalubuntu_linux
23.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
accountsservice
bullseye
0.6.55-3
fixed
bookworm
22.08.8-6
fixed
sid
23.13.9-7
fixed
trixie
23.13.9-7
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
accountsservice
mantic
Fixed 23.13.9-2ubuntu2
released
lunar
Fixed 22.08.8-1ubuntu7.1
released
kinetic
Fixed 22.08.8-1ubuntu1.1
released
jammy
Fixed 22.07.5-2ubuntu1.4
released
focal
Fixed 0.6.55-0ubuntu12~20.04.6
released
bionic
Fixed 0.6.45-1ubuntu1.3+esm1
released
xenial
Fixed 0.6.40-2ubuntu11.6+esm1
released
trusty
Fixed 0.6.35-0ubuntu7.3+esm3
released
Common Weakness Enumeration
References
https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297
https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/
https://ubuntu.com/security/notices/USN-6190-1
https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3297
https://securitylab.github.com/advisories/GHSL-2023-139_accountsservice/
https://ubuntu.com/security/notices/USN-6190-1