CVE-2023-33170: fedoraproject fedora Race Condition

CVSS: 8.1v3.1HighModified

AliasesRHSA-2023:4057RHSA-2023:4058RHSA-2023:4059+7 more

Published 11-07-2023Last modified 28-05-2026

Vulnerability summary

CVE-2023-33170 is a high (CVSS 8.1) Race Condition vulnerability in fedoraproject fedora. EPSS estimates a 1.99% chance of exploitation in the next 30 days, higher than 80.4% of scored vulnerabilities.

Overall risk

33/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.1/10

010

High · v3.1 (CVE.org)

EPSS score

1.99%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2023:4448 RHSA-2023:4449

Timeline

11-07-2023
PublishedVulnerability first disclosed.
28-05-2026
Last modifiedVulnerability information updated.

Description

ASP.NET and Visual Studio Security Feature Bypass Vulnerability

CVSS metrics

5 scores · 5 sources · 1 version

v3.18.1

EPSS trend

Probability

1.99%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

+0.02 pp

From 1.98% on 20-09-2026

20-09-202620-10-2026

EPSS score

1.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Redhat49 products

aspnetcore-runtime-6.0< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
aspnetcore-runtime-7.0< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
aspnetcore-targeting-pack-6.0< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
aspnetcore-targeting-pack-7.0< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet< 0:7.0.109-1.el8_8

dotnet-apphost-pack-6.0< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
dotnet-apphost-pack-6.0-debuginfo< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
dotnet-apphost-pack-7.0< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-apphost-pack-7.0-debuginfo< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-host< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-host-debuginfo< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-hostfxr-6.0< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
dotnet-hostfxr-6.0-debuginfo< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
dotnet-hostfxr-7.0< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-hostfxr-7.0-debuginfo< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-runtime-6.0< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
dotnet-runtime-6.0-debuginfo< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
dotnet-runtime-7.0< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-runtime-7.0-debuginfo< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-sdk-6.0< 0:6.0.120-1.el8_8 | < 0:6.0.120-1.el9_2
dotnet-sdk-6.0-debuginfo< 0:6.0.120-1.el8_8 | < 0:6.0.120-1.el9_2
dotnet-sdk-6.0-source-built-artifacts< 0:6.0.120-1.el8_8 | < 0:6.0.120-1.el9_2
dotnet-sdk-7.0< 0:7.0.109-1.el9_2 | < 0:7.0.109-1.el8_8
dotnet-sdk-7.0-debuginfo< 0:7.0.109-1.el9_2 | < 0:7.0.109-1.el8_8
dotnet-sdk-7.0-source-built-artifacts< 0:7.0.109-1.el9_2 | < 0:7.0.109-1.el8_8
dotnet-targeting-pack-6.0< 0:6.0.20-1.el8_8 | < 0:6.0.20-1.el9_2
dotnet-targeting-pack-7.0< 0:7.0.9-1.el9_2 | < 0:7.0.9-1.el8_8
dotnet-templates-6.0< 0:6.0.120-1.el8_8 | < 0:6.0.120-1.el9_2
dotnet-templates-7.0< 0:7.0.109-1.el9_2 | < 0:7.0.109-1.el8_8
dotnet6.0< 0:6.0.120-1.el8_8 | < 0:6.0.120-1.el9_2
dotnet6.0-debuginfo< 0:6.0.120-1.el8_8 | < 0:6.0.120-1.el9_2
dotnet6.0-debugsource< 0:6.0.120-1.el8_8 | < 0:6.0.120-1.el9_2
dotnet7.0< 0:7.0.109-1.el9_2 | < 0:7.0.109-1.el8_8
dotnet7.0-debuginfo< 0:7.0.109-1.el9_2 | < 0:7.0.109-1.el8_8
dotnet7.0-debugsource< 0:7.0.109-1.el9_2 | < 0:7.0.109-1.el8_8
netstandard-targeting-pack-2.1< 0:7.0.109-1.el9_2 | < 0:7.0.109-1.el8_8
rh-dotnet60-aspnetcore-runtime-6.0< 0:6.0.20-1.el7_9
rh-dotnet60-aspnetcore-targeting-pack-6.0< 0:6.0.20-1.el7_9
rh-dotnet60-dotnet< 0:6.0.120-1.el7_9
rh-dotnet60-dotnet-apphost-pack-6.0< 0:6.0.20-1.el7_9
rh-dotnet60-dotnet-debuginfo< 0:6.0.120-1.el7_9
rh-dotnet60-dotnet-host< 0:6.0.20-1.el7_9
rh-dotnet60-dotnet-hostfxr-6.0< 0:6.0.20-1.el7_9
rh-dotnet60-dotnet-runtime-6.0< 0:6.0.20-1.el7_9
rh-dotnet60-dotnet-sdk-6.0< 0:6.0.120-1.el7_9
rh-dotnet60-dotnet-sdk-6.0-source-built-artifacts< 0:6.0.120-1.el7_9
rh-dotnet60-dotnet-targeting-pack-6.0< 0:6.0.20-1.el7_9
rh-dotnet60-dotnet-templates-6.0< 0:6.0.120-1.el7_9
rh-dotnet60-netstandard-targeting-pack-2.1< 0:6.0.120-1.el7_9

Show all 49

NuGet14 products

Microsoft.AspNetCore.App.Runtime.linux-arm< 6.0.20 | ≥ 7.0.0, < 7.0.9
Microsoft.AspNetCore.App.Runtime.linux-arm64< 6.0.20 | ≥ 7.0.0, < 7.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-arm< 6.0.20 | ≥ 7.0.0, < 7.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64< 6.0.20 | ≥ 7.0.0, < 7.0.9
Microsoft.AspNetCore.App.Runtime.linux-musl-x64≥ 7.0.0, < 7.0.9 | < 6.0.20

Show all 14

Microsoft8 products

microsoft visual studio 2022 version 17.0≥ 17.0.0, < 17.0.23
microsoft visual studio 2022 version 17.2≥ 17.2.0, < 17.2.17
microsoft visual studio 2022 version 17.4≥ 17.4.0, < 17.4.9
microsoft visual studio 2022 version 17.6≥ 17.6.0, < 17.6.5
.net≥ 6.0.0, < 6.0.20 | ≥ 7.0.0, < 7.0.9

Show all 8

Ubuntu2 products

dotnet6< 6.0.120-0ubuntu1~22.04.1
dotnet7< 7.0.109-0ubuntu1~22.04.1

Fedoraproject1 product

fedoraEOL37 | 38

5 vendors · 74 products

References

32 links

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33170Vendor AdvisoryARTICLEREPORTWEBPatch
lists.fedoraproject.org/archives/…X TransferredMailing List
lists.fedoraproject.org/archives/…X TransferredMailing List
lists.fedoraproject.org/archives/…X TransferredMailing List
lists.fedoraproject.org/archives/…X TransferredMailing List
access.redhat.com/errata/RHSA-2023:4057Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2221854REPORT
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4057.jsonAdvisory
access.redhat.com/security/cve/CVE-2023-33170REPORT

Show all 32 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities