Logo
›
›vulnerability›CVE-2023-33864
Name
CVE-2023-33864
Source
NVD ( link)Debian ( link)
Description
StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize.
CWEs
CWE-190 CWE-190
Published Date
Updated Date
Workaround
-
Advisories
http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.htmlExploit
http://seclists.org/fulldisclosure/2023/Jun/2Exploit
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.htmlThird Party Advisory
https://renderdoc.org/Product
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txtExploit
http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.htmlExploit
http://seclists.org/fulldisclosure/2023/Jun/2Exploit
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.htmlThird Party Advisory
https://renderdoc.org/Product
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txtExploit

Analysis#

Affected Component
Analysis
renderdoc
Patched

Vulnerability Ratings#

9.8
CVSSv31
9.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
renderdoc
yocto
master
1.38
Not Affected
renderdoc
yocto
scarthgap
1.27
Not Affected

Resolved with patches#

renderdoc (yocto:kirkstone)

#
Title
Author
Resolve
1
Sanitise strings printed when received from target
baldurk <baldurk@baldurk.org>
CVE-2023-33836
CVE-2023-33864
CVE-2023-33865
2
Don't call ReadLargeBuffer for socket reads
baldurk <baldurk@baldurk.org>
CVE-2023-33836
CVE-2023-33864
CVE-2023-33865
3
Don't open symlinks when opening logfile
baldurk <baldurk@baldurk.org>
CVE-2023-33836
CVE-2023-33864
CVE-2023-33865
4
Verify array sizes when serialising for strings
baldurk <baldurk@baldurk.org>
CVE-2023-33863
CVE-2023-33864
CVE-2023-33865
5
Fix incorrect return type
baldurk <baldurk@baldurk.org>
CVE-2023-33836
CVE-2023-33864
CVE-2023-33865