RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership.

The remote host is affected by the vulnerability described in GLSA-202311-10 (RenderDoc: Multiple Vulnerabilities)

  - SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow.
    0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MAX) and then there is an attempt to add 1.
    (CVE-2023-33863)

  - StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer     Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize.
    (CVE-2023-33864)

  - RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the     /tmp/RenderDoc directory regardless of ownership. (CVE-2023-33865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0253-1 advisory.

  - SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow.
    0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MAX) and then there is an attempt to add 1.
    (CVE-2023-33863)

  - StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer     Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize.
    (CVE-2023-33864)

  - RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the     /tmp/RenderDoc directory regardless of ownership. (CVE-2023-33865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3501 advisory.

  - SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow.
    0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MAX) and then there is an attempt to add 1.
    (CVE-2023-33863)

  - StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer     Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize.
    (CVE-2023-33864)

  - RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the     /tmp/RenderDoc directory regardless of ownership. (CVE-2023-33865)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186270	GLSA-202311-10 : RenderDoc: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
181861	openSUSE 15 Security Update : renderdoc (openSUSE-SU-2023:0253-1)	Nessus	SuSE Local Security Checks	critical
178762	Debian DLA-3501-1 : renderdoc - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2023-33865

high

Tenable Plugins

critical

critical

critical