Log in Start free

Vulnerability · Published Apr 13, 2023 · Assigned by mitre

CVE-2023-30630

High 7.1

In plain English

A high-severity security flaw in the dmidecode package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.5%top 56.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed patch prevents dmidecode from writing to an existing file. However, there are multiple attack vectors that would not require overwriting an existing file that would provide the same level of unauthorized privilege escalation (e.g. creating a new file in /etc/cron.hourly).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8dmidecode1:3.3-4.el8_8.1ALSA-2023:5252
AlmaLinux:9dmidecode1:3.3-7.el9_2.1ALSA-2023:5061
Debian:12dmidecodeno fix listedDEBIAN-CVE-2023-30630
Debian:13dmidecode3.5-1DEBIAN-CVE-2023-30630
Debian:14dmidecode3.5-1DEBIAN-CVE-2023-30630
Rocky Linux:9dmidecode1:3.3-7.el9_2.1RLSA-2023:5061
Ubuntu:22.04:LTScpu-xno fix listedUBUNTU-CVE-2023-30630
Ubuntu:24.04:LTScpu-xno fix listedUBUNTU-CVE-2023-30630
Ubuntu:25.10cpu-xno fix listedUBUNTU-CVE-2023-30630
Ubuntu:26.04:LTScpu-xno fix listedUBUNTU-CVE-2023-30630
Ubuntu:26.10cpu-xno fix listedUBUNTU-CVE-2023-30630
Ubuntu:22.04:LTSdmidecodeno fix listedUBUNTU-CVE-2023-30630

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-23 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References