Vulnerability · Published Oct 28, 2023 · Assigned by mitre
CVE-2023-45897
Medium 5.5
In plain English
A medium-severity security flaw in the exfatprogs package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.4%top 65.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | exfatprogs | 1.2.2-2.el9 | ALSA-2024:2437 |
| Debian:12 | exfatprogs | 1.2.0-1+deb12u1 | DEBIAN-CVE-2023-45897 |
| Debian:13 | exfatprogs | 1.2.2-1 | DEBIAN-CVE-2023-45897 |
| Debian:14 | exfatprogs | 1.2.2-1 | DEBIAN-CVE-2023-45897 |
| Rocky Linux:9 | exfatprogs | 0:1.2.2-2.el9 | RLSA-2024:2437 |
| Ubuntu:22.04:LTS | exfatprogs | 1.1.3-1ubuntu0.1 | USN-6970-1 |
| Ubuntu:22.04:LTS | exfatprogs | 1.1.3-1ubuntu0.1 | UBUNTU-CVE-2023-45897 |
Affected products (as reported)
References
- https://github.com/exfatprogs/exfatprogs/commit/ec78688e5fb5a70e13df82b4c0da1e6228d3ccdf
- https://github.com/exfatprogs/exfatprogs/releases/tag/1.2.2
- https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4
- https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae
- https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/
- https://lists.debian.org/debian-lts-announce/2024/09/msg00003.html