Every CVE Search/ Get API key

CVE-2023-28938

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2...

3.4 LowFix available

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.21%Up 0.2 points since Aug 11, 2023
90%50%10%1%

What each source reports

CVE List Score used 3.4

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
CVE-2023-28938
CVSS 3.1
3.4 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2023-32556 3.4

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
EUVD-2023-32556
CVSS 3.1
3.4 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-pxxq-frx3-rf22 3.4

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2...

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
GHSA-pxxq-frx3-rf22
CVSS 3.1
3.4 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Weakness
CWE-400
Updated
2026-11-02
NVD 3.4

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
CVE-2023-28938
CVSS 3.1
3.4 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVAZL-27937 4.4

CVE-2023-28938 affecting package mdadm for versions less than 4.1-11

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
AZL-27937
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-34975 4.4

CVE-2023-28938 affecting package mdadm for versions less than 4.2-1

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
AZL-34975
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVBELL-CVE-2023-28938 4.4

CVE-2023-28938 does not affect BellSoft software

Record
BELL-CVE-2023-28938
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 4.4

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
CVE-2023-28938
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28938 4.4

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
DEBIAN-CVE-2023-28938
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1647 4.4

mdadm security update

mdadm is a tool for managing Linux Software RAID arrays. It can create, assemble, report on, and monitor arrays. It can also move spares between raid arrays when needed.

Security Fix(es):

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.(CVE-2023-28938)

Record
OESA-2023-1647
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1648 4.4

mdadm security update

mdadm is a tool for managing Linux Software RAID arrays. It can create, assemble, report on, and monitor arrays. It can also move spares between raid arrays when needed.

Security Fix(es):

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.(CVE-2023-28938)

Record
OESA-2023-1648
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2023-1649 6.7

mdadm security update

mdadm is a tool for managing Linux Software RAID arrays. It can create, assemble, report on, and monitor arrays. It can also move spares between raid arrays when needed.

Security Fix(es):

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2023-28736)

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.(CVE-2023-28938)

Record
OESA-2023-1649
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-28938 3.4

Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.

Record
UBUNTU-CVE-2023-28938
CVSS 3.1
3.4 LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
CVSS 3.1
4.4 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2023:3691-1 No score

Security update for mdadm

This update for mdadm fixes the following issues:

  • CVE-2023-28736: Fixed a buffer overflow (bsc#1214244).
  • CVE-2023-28938: Fixed uncontrolled resource consumption (bsc#1214245).
Record
SUSE-SU-2023:3691-1
Updated
2026-11-02
OSVSUSE-SU-2023:3953-1 No score

Security update for mdadm

This update for mdadm fixes the following issues:

  • CVE-2023-28736: Fixed a buffer overflow (bsc#1214244).
  • CVE-2023-28938: Fixed uncontrolled resource consumption (bsc#1214245).
Record
SUSE-SU-2023:3953-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mdadm
Azure Linux:2
 before 4.1-11
4.1-11
mdadm
Azure Linux:3
 before 4.2-1
4.2-1
mdadm
Debian:12
 before 4.2~rc2-2
4.2~rc2-2
mdadm
Debian:13
 before 4.2~rc2-2
4.2~rc2-2
mdadm
Debian:14
 before 4.2~rc2-2
4.2~rc2-2
mdadm
openEuler:20.03-LTS-SP1
 before 4.1-rc2.0.16.oe1
4.1-rc2.0.16.oe1
mdadm
openEuler:20.03-LTS-SP3
 before 4.1-rc2.0.16.oe1
4.1-rc2.0.16.oe1
mdadm
openEuler:22.03-LTS
From an advisory covering 2 CVEs
 before 4.1-11.oe2203
4.1-11.oe2203
mdadm
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 2 CVEs
 before 4.1-4.29.1
4.1-4.29.1
mdadm
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 2 CVEs
 before 4.1-4.29.1
4.1-4.29.1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
mdadm
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Linux Enterprise Module for Basesystem 15 SP4
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Manager Proxy 4.2
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Manager Server 4.2
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
openSUSE:Leap 15.4
From an advisory covering 2 CVEs
 before 4.1-150300.24.33.1
4.1-150300.24.33.1
mdadm
Ubuntu:14.04:LTS
 All versions, plus listed versions
3.2.5-5ubuntu23.2.5-5ubuntu33.2.5-5ubuntu43.2.5-5ubuntu4.13.2.5-5ubuntu4.23.2.5-5ubuntu4.33.2.5-5ubuntu4.4
 None known
mdadm
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.3-2ubuntu23.3-2ubuntu33.3-2ubuntu43.3-2ubuntu53.3-2ubuntu6
Show 6 moreShow less
3.3-2ubuntu73.3-2ubuntu7.13.3-2ubuntu7.23.3-2ubuntu7.43.3-2ubuntu7.53.3-2ubuntu7.6
 None known
mdadm
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.0-24.0-2ubuntu14.0-2ubuntu1.14.1~rc1-3~ubuntu18.04.14.1~rc1-3~ubuntu18.04.24.1~rc1-3~ubuntu18.04.4
 None known
mdadm
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.1-2ubuntu34.1-4ubuntu14.1-5ubuntu14.1-5ubuntu1.2
 None known
mdadm
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.2~rc2-2ubuntu14.2-0ubuntu14.2-0ubuntu2
 None known

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28938 is a low vulnerability (CVSS 3.4) in Mdadm Project Mdadm, published August 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in mdadm 4.1-11.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open