Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed patch prevents dmidecode from writing to an existing file. However, there are multiple attack vectors that would not require overwriting an existing file that would provide the same level of unauthorized privilege escalation (e.g. creating a new file in /etc/cron.hourly).
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dmidecode | Sep 15, 2023 | Apr 13, 2023 |
| Alpine Linux | — | Upgrade dmidecode | Mar 21, 2024 | Apr 13, 2023 |
| Amazon Linux Ami 2 | — | Upgrade dmidecode-debuginfoUpgrade dmidecode | Jan 10, 2024 | Apr 13, 2023 |
| Amazon_linux_2023 | — | Upgrade dmidecode-debugsourceUpgrade dmidecode-debuginfoUpgrade dmidecode | Feb 17, 2025 | Apr 13, 2023 |
| Centos_linux | — | Upgrade dmidecodeUpgrade dmidecode-debugsourceUpgrade dmidecode-debuginfo | Sep 13, 2023 | Apr 13, 2023 |
| Debian | — | No solution existsUpgrade dmidecode | May 15, 2025 | Apr 13, 2023 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Gentoo Linux | — | Upgrade sys-apps/dmidecode. | Jul 25, 2024 | Apr 13, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade dmidecode | Jul 18, 2023 | Apr 13, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade dmidecode | Jan 10, 2024 | Apr 13, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade dmidecode | Jan 10, 2024 | Apr 13, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade dmidecode | Jul 10, 2023 | Apr 13, 2023 |
| Oracle_linux | — | Upgrade dmidecode | Sep 13, 2023 | Apr 13, 2023 |
| Redhat_linux | — | No solution existsUpgrade dmidecodeUpgrade dmidecode-debugsourceUpgrade dmidecode-debuginfo | Sep 13, 2023 | Apr 13, 2023 |
| Rocky_linux | — | Upgrade dmidecode-debuginfoUpgrade dmidecode-debugsourceUpgrade dmidecode | Mar 5, 2024 | Apr 13, 2023 |
| Suse | — | Upgrade dmidecode | Apr 24, 2023 | Apr 13, 2023 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 13, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 13, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub