Logo
›
›vulnerability›CVE-2023-33863
Name
CVE-2023-33863
Source
NVD ( link)Debian ( link)
Description
SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MAX) and then there is an attempt to add 1.
CWEs
CWE-190 CWE-190
Published Date
Updated Date
Workaround
-
Advisories
http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.htmlExploit
http://seclists.org/fulldisclosure/2023/Jun/2Exploit
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.htmlThird Party Advisory
https://renderdoc.org/Product
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txtExploit
http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.htmlExploit
http://seclists.org/fulldisclosure/2023/Jun/2Exploit
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.htmlThird Party Advisory
https://renderdoc.org/Product
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txtExploit

Analysis#

Affected Component
Analysis
renderdoc
Patched

Vulnerability Ratings#

9.8
CVSSv31
9.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
renderdoc
yocto
master
1.38
Not Affected
renderdoc
yocto
scarthgap
1.27
Not Affected

Resolved with patches#

renderdoc (yocto:kirkstone)

#
Title
Author
Resolve
1
Verify array sizes when serialising for strings
baldurk <baldurk@baldurk.org>
CVE-2023-33863
CVE-2023-33864
CVE-2023-33865