Every CVE Search/ Get API key

CVE-2023-28736

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a...

5.7 MediumFix available

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.22%Up 0.2 points since Aug 11, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.7

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
CVE-2023-28736
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-120
Updated
2026-11-02
EUVDEUVD-2023-32374 5.7

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
EUVD-2023-32374
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-4953-8925-rqj6 5.7

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a...

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
GHSA-4953-8925-rqj6
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-120
Updated
2026-11-02
NVD 5.7

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
CVE-2023-28736
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-120
Updated
2026-11-02
OSVAZL-27938 6.7

CVE-2023-28736 affecting package mdadm for versions less than 4.1-10

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
AZL-27938
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-34974 6.7

CVE-2023-28736 affecting package mdadm for versions less than 4.2-1

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
AZL-34974
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVBELL-CVE-2023-28736 6.7

CVE-2023-28736 does not affect BellSoft software

Record
BELL-CVE-2023-28736
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 6.7

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
CVE-2023-28736
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28736 6.7

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
DEBIAN-CVE-2023-28736
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2023-1649 6.7

mdadm security update

mdadm is a tool for managing Linux Software RAID arrays. It can create, assemble, report on, and monitor arrays. It can also move spares between raid arrays when needed.

Security Fix(es):

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2023-28736)

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.(CVE-2023-28938)

Record
OESA-2023-1649
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-28736 5.7

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Record
UBUNTU-CVE-2023-28736
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2023:3691-1 No score

Security update for mdadm

This update for mdadm fixes the following issues:

  • CVE-2023-28736: Fixed a buffer overflow (bsc#1214244).
  • CVE-2023-28938: Fixed uncontrolled resource consumption (bsc#1214245).
Record
SUSE-SU-2023:3691-1
Updated
2026-11-02
OSVSUSE-SU-2023:3953-1 No score

Security update for mdadm

This update for mdadm fixes the following issues:

  • CVE-2023-28736: Fixed a buffer overflow (bsc#1214244).
  • CVE-2023-28938: Fixed uncontrolled resource consumption (bsc#1214245).
Record
SUSE-SU-2023:3953-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mdadm
Azure Linux:2
 before 4.1-10
4.1-10
mdadm
Azure Linux:3
 before 4.2-1
4.2-1
mdadm
Debian:12
 before 4.2-1
4.2-1
mdadm
Debian:13
 before 4.2-1
4.2-1
mdadm
Debian:14
 before 4.2-1
4.2-1
mdadm
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 4.1-11.oe2203
4.1-11.oe2203
mdadm
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 2 CVEs
 before 4.1-4.29.1
4.1-4.29.1
mdadm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 2 CVEs
 before 4.1-4.29.1
4.1-4.29.1
mdadm
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
mdadm
SUSE:Linux Enterprise Module for Basesystem 15 SP4
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Manager Proxy 4.2
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Manager Server 4.2
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
Ubuntu:14.04:LTS
 All versions, plus listed versions
3.2.5-5ubuntu23.2.5-5ubuntu33.2.5-5ubuntu43.2.5-5ubuntu4.13.2.5-5ubuntu4.23.2.5-5ubuntu4.33.2.5-5ubuntu4.4
 None known
mdadm
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.3-2ubuntu23.3-2ubuntu33.3-2ubuntu43.3-2ubuntu53.3-2ubuntu6
Show 6 moreShow less
3.3-2ubuntu73.3-2ubuntu7.13.3-2ubuntu7.23.3-2ubuntu7.43.3-2ubuntu7.53.3-2ubuntu7.6
 None known
mdadm
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.0-24.0-2ubuntu14.0-2ubuntu1.14.1~rc1-3~ubuntu18.04.14.1~rc1-3~ubuntu18.04.24.1~rc1-3~ubuntu18.04.4
 None known
mdadm
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.1-2ubuntu34.1-4ubuntu14.1-5ubuntu14.1-5ubuntu1.2
 None known
mdadm
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.2~rc2-2ubuntu14.2-0ubuntu14.2-0ubuntu2
 None known

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28736 is a medium vulnerability (CVSS 5.7) in Mdadm Project Mdadm, published August 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in mdadm 4.1-10.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open