Moderate: dmidecode security update
Summary
ALSA-2023:5061: Moderate: dmidecode security update. Affects dmidecode versions < 1:3.3-7.el9_2.1. Fixed in 1:3.3-7.el9_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dmidecode packages provide utilities for extracting Intel 64 and Intel Itanium hardware information from the system BIOS or Extensible Firmware Interface (EFI), depending on the SMBIOS/DMI standard. This information typically includes system manufacturer, model name, serial number, BIOS version, and asset tag, as well as other details, depending on the manufacturer.
Vulnerability Detail
The vulnerability in dmidecode allows an attacker to overwrite a local file using the dump-bin command. This can lead to unauthorized modification or deletion of important files on the system. The impact of this vulnerability can vary depending on the specific file being overwritten and the privileges of the attacker. It is rated as moderate severity.
How To Fix
Minimum fixed version
1:3.3-7.el9_2.1
This is the first release that contains the fix.
sudo dnf update dmidecodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The dmidecode package has a moderate severity vulnerability that allows an attacker to overwrite local files. It is important to update the package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for dmidecode →
FAQ
dmidecode is a utility that extracts hardware information from the system BIOS or EFI. It provides details such as system manufacturer, model name, serial number, BIOS version, and asset tag.
The vulnerability allows an attacker to overwrite local files, which can lead to unauthorized modification or deletion of important data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will alert you in real-time.
Currently, there is no known workaround for this vulnerability. It is recommended to update the dmidecode package to the latest version.
You can find more information about this vulnerability, including the CVE identifier, on the CVE page listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for dmidecode.
