Permissions, Privileges, and Access Controls in dmidecode - CVE-2023-30630

Vulnerability identifier: #VU75432

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-30630

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions when executing the command with the "--dump-bin" option. A local user can overwrite arbitrary files on the system and escalate privileges.

dmidecode
Migration Toolkit for Containers
Amazon Linux AMI
Oracle Linux
Gentoo Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
openEuler
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
Robotic Process Automation for Cloud Pak
ObjectScale
IBM Cloud Pak for Watson AIOps
Total Storage Service Console (TSSC) / TS4500 IMC
IBM Sterling Order Management
EMC Cloud Tiering Appliance
Migration Toolkit for Runtimes
OpenShift Pipelines
Cryostat
Migration Toolkit for Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Advanced Cluster Security for Kubernetes
OpenShift Logging
Red Hat Migration Toolkit for Applications
IBM Security Verify Governance
Node Health Check Operator
Self Node Remediation Operator
Multicluster Engine for Kubernetes
OpenShift Service Mesh
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Security Guardium
dmidecode-debuginfo
dmidecode
dmidecode-debugsource
dmidecode (Red Hat package)
dmidecode-doc
sys-apps/dmidecode
Dell EMC NetWorker vProxy

Install updates from vendor's website.

dmidecode - update to 3.5
Node Health Check Operator - addressed in versions 0.4.1, 0.6.1
Self Node Remediation Operator - addressed in versions 0.5.1, 0.7.1
Migration Toolkit for Containers - addressed in versions 1.7.13, 1.8.0
OpenShift Pipelines - addressed in versions 1.10.6, 1.11.2, 1.12.1
Multicluster Engine for Kubernetes - addressed in versions 2.1.9, 2.2.9, 2.3.2
OpenShift Service Mesh - addressed in versions 2.2.11, 2.3.8, 2.4.4
Migration Toolkit for Virtualization - update to 2.4.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.6.8, 2.7.9, 2.8.2
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.0.5, 4.1.4
OpenShift Virtualization - update to 4.11.7
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.13.3, 4.14.0
OpenShift Logging - addressed in versions 5.5.17, 5.6.12, 5.7.7
Red Hat Migration Toolkit for Applications - update to 6.1.4
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.11, 23.0.12
ObjectScale - update to 1.4.0
dmidecode-debuginfo - addressed in versions 3.0-10.6.1, 3.2-150100.9.16.1, 3.4-150400.16.8.1
dmidecode - addressed in versions 3.0-10.6.1, 3.2-150100.9.16.1, 3.4-150400.16.8.1
dmidecode-debugsource - addressed in versions 3.0-10.6.1, 3.2-150100.9.16.1, 3.4-150400.16.8.1
dmidecode-debuginfo - update to 3.2-4
dmidecode-debugsource - update to 3.2-4
dmidecode - update to 3.2-4
dmidecode (Red Hat package) - addressed in versions 3.3-4.el8_8.1, 3.3-7.el9_2.1
dmidecode - update to 3.3-5.0.2
dmidecode-doc - update to 3.3-5.0.2
sys-apps/dmidecode - update to 3.5
dmidecode - update to 3.5-1
IBM Cloud Pak for Watson AIOps - update to 4.4.0
Total Storage Service Console (TSSC) / TS4500 IMC - addressed in versions 9.4.26, 9.5.8
IBM Security Verify Governance - update to 10.0.2.0.4
IBM Sterling Order Management - update to 10.0.2403.1
EMC Cloud Tiering Appliance - addressed in versions 13.1.0.2.33, 13.2.0.2.24
Dell EMC NetWorker vProxy - addressed in versions 19.8.0.3, 19.9.0.2

• https://lists.nongnu.org/archive/html/dmidecode-devel/2023-03/msg00003.html
• https://github.com/adamreiser/dmiwrite
• https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=6ca381c1247c81f74e1ca4e7706f70bdda72e6f2
• https://git.savannah.nongnu.org/cgit/dmidecode.git/commit/?id=d8cfbc808f387e87091c25e7d5b8c2bb348bb206

• Privilege escalation in Dmidecode
• SUSE update for dmidecode
• SUSE update for dmidecode
• SUSE update for dmidecode
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Red Hat Enterprise Linux 9 update for dmidecode
• Red Hat Enterprise Linux 8 update for dmidecode
• Multiple vulnerabilities in OpenShift Virtualization 4.13
• Permissions, privileges, and access controls in Dell NetWorker vProxy
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.3
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.8
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.1
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC) 1.7
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh for 2.4
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.2
• Multiple vulnerabilities in Logging Subsystem 5.6 for Red Hat OpenShift
• Multiple vulnerabilities in Logging Subsystem 5.7 for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat Self Node Remediation Operator 0.5
• Multiple vulnerabilities in Red Hat Self Node Remediation Operator 0.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.0
• Multiple vulnerabilities in Logging Subsystem 5.5 for Red Hat OpenShift
• Multiple vulnerabilities in Cryostat 2 on RHEL 8
• Multiple vulnerabilities in Red Hat OpenShift Pipelines 1.12
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.6
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.1
• Multiple vulnerabilities in Red Hat OpenShift Virtualization release 4.11
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.7
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.2
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1 on RHEL 8
• Multiple vulnerabilities in Node Health Check Operator 0.6
• Multiple vulnerabilities in Node Health Check Operator 0.4
• Multiple vulnerabilities in Migration Toolkit for Applications 6.1
• Multiple vulnerabilities in Red Hat OpenShift Pipelines 1.11
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.14
• Multiple vulnerabilities in Dell NetWorker vProxy
• Multiple vulnerabilities in Red Hat OpenShift Pipelines 1.10
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• openEuler update for dmidecode
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Sterling Order Management
• Permissions, privileges, and access controls in IBM Total Storage Service Console (TSSC) / TS4500 IMC
• Gentoo update for Dmidecode
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM Security Verify Governance - Identity Manager
• Amazon Linux AMI update for dmidecode
• Anolis OS update for dmidecode