CVE-2023-33865 – CVE-2023-33865 is a local privilege escalation ... (How to Fix)

Q: What is the severity of CVE-2023-33865?

CVE-2023-33865 has a CVSS score of 7.8 (HIGH). CVE-2023-33865 is a local privilege escalation vulnerability in RenderDoc that allows attackers to gain elevated privileges via symlink attacks. It affects RenderDoc installations where the software creates or uses the /tmp/RenderDoc directory without proper ownership validation. Users running vulnerable versions of RenderDoc on Unix-like systems are affected.

📋 TL;DR

CVE-2023-33865 is a local privilege escalation vulnerability in RenderDoc that allows attackers to gain elevated privileges via symlink attacks. It affects RenderDoc installations where the software creates or uses the /tmp/RenderDoc directory without proper ownership validation. Users running vulnerable versions of RenderDoc on Unix-like systems are affected.

💻 Affected Systems

Products:

RenderDoc

Versions: All versions before 1.27

Operating Systems: Linux, Unix-like systems, macOS

Default Config Vulnerable: ⚠️ Yes

Notes: Windows systems are not affected as they don't use /tmp directory structure in the same way. The vulnerability requires local access to the system.

📦 What is this software?

Renderdoc by Renderdoc

View all CVEs affecting Renderdoc →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attacker gains root/system privileges, leading to complete system compromise, data theft, and persistent backdoor installation.

🟠

Likely Case

Local user escalates privileges to execute arbitrary code with higher permissions, potentially accessing sensitive data or modifying system files.

🟢

If Mitigated

Attack fails due to proper directory permissions, sandboxing, or the absence of symlink vulnerabilities in the environment.

🌐 Internet-Facing: LOW - This is a local attack requiring access to the system; not directly exploitable over the network.

🏢 Internal Only: HIGH - Any local user on a system with vulnerable RenderDoc can potentially escalate privileges.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires local access and ability to create symlinks. Public exploit details are available in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.27 and later

Vendor Advisory: https://renderdoc.org/

Restart Required: Yes

Instructions:

1. Download RenderDoc 1.27 or later from https://renderdoc.org/ 2. Uninstall old version 3. Install new version 4. Restart any RenderDoc processes

🔧 Temporary Workarounds

Secure /tmp/RenderDoc directory

linux

Set proper ownership and permissions on the RenderDoc temporary directory to prevent symlink attacks

sudo chown root:root /tmp/RenderDoc
sudo chmod 755 /tmp/RenderDoc

Use private temporary directory

linux

Configure RenderDoc to use a private, secure temporary directory instead of /tmp

export RENDERDOC_TEMP_DIR=/secure/path/for/renderdoc

🧯 If You Can't Patch

Restrict local user access to systems running RenderDoc
Monitor for symlink creation in /tmp/RenderDoc directory

🔍 How to Verify

Check if Vulnerable:

Check RenderDoc version: renderdoccmd --version. If version is below 1.27, system is vulnerable.

Check Version:

renderdoccmd --version

Verify Fix Applied:

Verify RenderDoc version is 1.27 or higher and check that /tmp/RenderDoc directory has proper permissions (owned by root, not world-writable).

📡 Detection & Monitoring

Log Indicators:

Symlink creation in /tmp/RenderDoc
Unauthorized privilege escalation attempts
RenderDoc process running with elevated privileges unexpectedly

Network Indicators:

None - this is a local attack

SIEM Query:

process_name:"renderdoc" AND parent_process_name NOT IN ("bash", "sh", "zsh")

📊 Metadata

CVE ID: CVE-2023-33865

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-59

Published: June 7, 2023

Last Updated: November 3, 2025

🔗 References

http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2023/Jun/2 Exploit,Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.html Third Party Advisory
https://renderdoc.org/ Product
https://security.gentoo.org/glsa/202311-10
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txt Exploit,Third Party Advisory
http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2023/Jun/2 Exploit,Mailing List,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00023.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00008.html
https://renderdoc.org/ Product
https://security.gentoo.org/glsa/202311-10
https://www.qualys.com/2023/06/06/renderdoc/renderdoc.txt Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-33865, you might also want to check these: