Skip to content
Fencer Vulns
high 7.1

CVE-2023-30630 json

Dmidecode before 3.5 allows -dump-bin to overwrite a local file.

published 2023-04-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-34994

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed patch prevents dmidecode from writing to an existing file. However, there are multiple attack vectors that would not require overwriting an existing file that would provide the same level of unauthorized privilege escalation (e.g. creating a new file in /etc/cron.hourly).

Patch / fix

  • nongnu dmidecode 3.5
  • dmidecode Debian 14, Debian 13 3.5-1

debian advisories DEBIAN-CVE-2023-30630

  • dmidecode RHEL 8 1:3.3-4.el8_8.1
  • dmidecode RHEL 9 1:3.3-7.el9_2.1

red hat advisories RHSA-2023:5252RHSA-2023:5061

  • dmidecode SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +14 more 3.2-150100.9.16.1
  • dmidecode SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +5 more 3.0-10.6.1
  • dmidecode SLE Module for Basesystem 15 SP4, SLE Micro 5.4, SLE Micro 5.3 +2 more 3.4-150400.16.8.1

suse advisories SUSE-SU-2023:2215-1SUSE-SU-2023:2044-1SUSE-SU-2023:1947-1

  • dmidecode AlmaLinux 8 1:3.3-4.el8_8.1
  • dmidecode AlmaLinux 9 1:3.3-7.el9_2.1

almalinux advisories ALSA-2023:5252ALSA-2023:5061

  • dmidecode Rocky Linux 9 1:3.3-7.el9_2.1

rocky linux advisories RLSA-2023:5061

  • dmidecode CBL-Mariner 2.0 3.5-1

azure linux advisories AZL-26138

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-30630 updated cvss 7.1

dmidecode: dump-bin to overwrite a local file

  • Red Hat Enterprise Linux 6 dmidecode Red Hat Enterprise Linux 7 dmidecode
    affected: workaround, no fix planned “Do not configure sudoers file to allow running dmidecode with elevated privileges.”
  • Red Hat Enterprise Linux BaseOS (v. 8) dmidecode 3.3-4.el8_8.1
    fixed: vendor fix “Do not configure sudoers file to allow running dmidecode with elevated privileges.” RHSA-2023:5252
  • Red Hat Enterprise Linux BaseOS (v. 9) dmidecode 3.3-7.el9_2.1
    fixed: vendor fix “Do not configure sudoers file to allow running dmidecode with elevated privileges.” RHSA-2023:5061

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/adamreiser/dmiwrite referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Classification

Weakness
  • CWE-23 Relative Path Traversal

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.