CVE-2023-3297

2023-06-2800:00:00

ubuntu.com

ubuntu

accountsservice

use-after-free

vulnerability

d-bus

accounts-daemon

local attacker

ghsl-2023-139

0010-set-language.patch

cwe-416

CVSS3

8.1

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

In Ubuntu’s accountsservice an unprivileged local attacker can trigger a
use-after-free vulnerability in accountsservice by sending a D-Bus message
to the accounts-daemon process.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/2024182>

Notes

Author	Note
mdeslaur	This is GHSL-2023-139 Issue is in the Ubuntu-specific 0010-set-language.patch patch.
eslerm	CWE-416

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchaccountsservice< 0.6.45-1ubuntu1.3+esm1UNKNOWN
ubuntu20.04noarchaccountsservice< 0.6.55-0ubuntu12~20.04.6UNKNOWN
ubuntu22.04noarchaccountsservice< 22.07.5-2ubuntu1.4UNKNOWN
ubuntu22.10noarchaccountsservice< 22.08.8-1ubuntu1.1UNKNOWN
ubuntu23.04noarchaccountsservice< 22.08.8-1ubuntu7.1UNKNOWN
ubuntu23.10noarchaccountsservice< 23.13.9-2ubuntu2UNKNOWN
ubuntu14.04noarchaccountsservice< 0.6.35-0ubuntu7.3+esm3UNKNOWN
ubuntu16.04noarchaccountsservice< 0.6.40-2ubuntu11.6+esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	accountsservice	< 0.6.45-1ubuntu1.3+esm1	UNKNOWN
ubuntu	20.04	noarch	accountsservice	< 0.6.55-0ubuntu12~20.04.6	UNKNOWN
ubuntu	22.04	noarch	accountsservice	< 22.07.5-2ubuntu1.4	UNKNOWN
ubuntu	22.10	noarch	accountsservice	< 22.08.8-1ubuntu1.1	UNKNOWN
ubuntu	23.04	noarch	accountsservice	< 22.08.8-1ubuntu7.1	UNKNOWN
ubuntu	23.10	noarch	accountsservice	< 23.13.9-2ubuntu2	UNKNOWN
ubuntu	14.04	noarch	accountsservice	< 0.6.35-0ubuntu7.3+esm3	UNKNOWN
ubuntu	16.04	noarch	accountsservice	< 0.6.40-2ubuntu11.6+esm1	UNKNOWN