Read the docs
TI-2023-03085 Aliases CVE-2023-3297GHSA-gr7p-26mx-9pgw

Use after free in Canonical AccountService

Priority HIGH 70CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0033 26th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed AccountService (Canonical Ltd.): 23.13.9-2ubuntu2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CanonicalAccountService—23.13.9-2ubuntu2Patch availableCNA
  • AccountService VendorCanonical Affected — Fixed in 23.13.9-2ubuntu2 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:*before 23.13.9-2ubuntu2VulnerableCanonical
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:*before 22.08.8-1ubuntu7.1VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*23.04Running onCanonical
cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*22.10Running onCanonical
cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:*before 22.07.5-2ubuntu1.4VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*22.04Running onCanonical
cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:*before 0.6.55-0ubuntu12\~20.04.6VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04Running onCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
  • cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:* Versions before 23.13.9-2ubuntu2 Vulnerable ·Canonical
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:* Versions before 22.08.8-1ubuntu7.1 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:* Versions 23.04 Running on ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:* Versions 22.10 Running on ·Canonical
  • cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:* Versions before 22.07.5-2ubuntu1.4 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Running on ·Canonical
  • cpe:2.3:a:canonical:accountsservice:*:*:*:*:*:*:*:* Versions before 0.6.55-0ubuntu12\~20.04.6 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Running on ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*22.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*22.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:*23.04VulnerableCanonical
  • cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:* Versions 22.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:* Versions 22.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:*:*:*:* Versions 23.04 Vulnerable ·Canonical

Remediation

  • Fix · CNA AccountService (Canonical Ltd.) Fixed in 23.13.9-2ubuntu2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-3297
  2. 2026-10-03 Alias added: GHSA-gr7p-26mx-9pgw

References

Exploit 2

Advisory 2

  • TI-2021-02844 Free of static data in accountsservice CVSS 3.1HIGH 7.8
  • TI-2022-01670 Accountsservice incorrectly drops privileges CVSS 3.1MEDIUM 5.5
  • TI-2011-03840 The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop… CVSS 2.0LOW 3.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences