Path Traversal in Nongnu Dmidecode
CVE-2023-30630
Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed patch prevents dmidecode from writing to an existing file. However, there are multiple attack vectors that would not require overwriting an existing file that would provide the same level of unauthorized privilege escalation (e.g. creating a new file in /etc/cron.hourly).
EPSS: 0.005 (41.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.
Affected products
- Nongnu Dmidecode
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org (Patch, Mailing List, Release Notes, Vendor Advisory)
- cve@mitre.org (Not Applicable)
- cve@mitre.org (Not Applicable)
Frequently asked questions
- What is CVE-2023-30630?
- CVE-2023-30630 is a high-severity vulnerability in Nongnu Dmidecode, classified under Relative Path Traversal. CVSS score: 7.1/10. Published 2023-04-13.
- How severe is CVE-2023-30630?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2023-30630 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.