CVE-2023-30630

2023-04-1300:00:00

ubuntu.com

dmidecode

file overwrite

security relevance

sudo execution

non-default configuration

elevated privileges

upstream commits

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

0.0004 Low

EPSS

Percentile

10.0%

JSON

Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has
security relevance because, for example, execution of Dmidecode via Sudo is
plausible.

Notes

Author	Note
rodrigo-zaiden	cpu-x embedds dmidecode source
mdeslaur	This CVE relies on an improbable non-default configuration of allowing an unprivileged user to run demidecode under sudo with a specific insecure configuration in the sudoers file. Using dmidecode in such a manner is no different than allowing any other tool to unexpectedly run with elevated privileges. Setting priority to low. The upstream commits listed below only prevent overwriting a file as root, but still allows creating arbitrary files as root so using dmidecode with elevated privileges via sudoers is still unsafe.

Author

Note

rodrigo-zaiden

cpu-x embedds dmidecode source

mdeslaur

This CVE relies on an improbable non-default configuration of allowing an unprivileged user to run demidecode under sudo with a specific insecure configuration in the sudoers file. Using dmidecode in such a manner is no different than allowing any other tool to unexpectedly run with elevated privileges. Setting priority to low. The upstream commits listed below only prevent overwriting a file as root, but still allows creating arbitrary files as root so using dmidecode with elevated privileges via sudoers is still unsafe.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchcpu-x< anyUNKNOWN
ubuntu22.04noarchcpu-x< anyUNKNOWN
ubuntu23.10noarchcpu-x< anyUNKNOWN
ubuntu24.04noarchcpu-x< anyUNKNOWN
ubuntu18.04noarchdmidecode< anyUNKNOWN
ubuntu20.04noarchdmidecode< anyUNKNOWN
ubuntu22.04noarchdmidecode< anyUNKNOWN
ubuntu23.10noarchdmidecode< anyUNKNOWN
ubuntu24.04noarchdmidecode< anyUNKNOWN
ubuntu14.04noarchdmidecode< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	cpu-x	< any	UNKNOWN
ubuntu	22.04	noarch	cpu-x	< any	UNKNOWN
ubuntu	23.10	noarch	cpu-x	< any	UNKNOWN
ubuntu	24.04	noarch	cpu-x	< any	UNKNOWN
ubuntu	18.04	noarch	dmidecode	< any	UNKNOWN
ubuntu	20.04	noarch	dmidecode	< any	UNKNOWN
ubuntu	22.04	noarch	dmidecode	< any	UNKNOWN
ubuntu	23.10	noarch	dmidecode	< any	UNKNOWN
ubuntu	24.04	noarch	dmidecode	< any	UNKNOWN
ubuntu	14.04	noarch	dmidecode	< any	UNKNOWN