Use-after-free in vCenter Server - CVE-2023-20893
Published: June 22, 2023
Vulnerability identifier: #VU77636
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-20893
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in DCERPC protocol implementation. A remote attacker can send specially crafted packets to the server, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Affected software
vCenter Server
Dell EMC VxRail Appliance
Dell EMC VxRail Appliance
How to mitigate CVE-2023-20893
Install updates from vendor's website.
vCenter Server - addressed in versions 7.0 U3m, 8.0 U1b
Dell EMC VxRail Appliance - update to 8.0.101
Dell EMC VxRail Appliance - update to 8.0.101