{"id":"CVE-2023-28938","aliases":["AZL-27937","AZL-34975","BELL-CVE-2023-28938","DEBIAN-CVE-2023-28938","EUVD-2023-32556","GHSA-pxxq-frx3-rf22","OESA-2023-1647","OESA-2023-1648","OESA-2023-1649","SUSE-SU-2023:3691-1","SUSE-SU-2023:3953-1","UBUNTU-CVE-2023-28938"],"status":"published","title":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2...","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","severity":{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00215,"percentile":0.11994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-08-11T02:36:51Z","modified":"2026-10-26T18:01:03Z","fixes":[{"ecosystem":"Azure Linux:2","package":"mdadm","fixed_in":["4.1-11"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"mdadm","fixed_in":["4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mdadm","fixed_in":["4.2~rc2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mdadm","fixed_in":["4.2~rc2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mdadm","fixed_in":["4.2~rc2-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"mdadm","fixed_in":["4.1-rc2.0.16.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"mdadm","fixed_in":["4.1-rc2.0.16.oe1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2~rc2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2~rc2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2~rc2-2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-rc2.0.16.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-rc2.0.16.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-4.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-4.29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150300.24.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150300.24.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150300.24.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150300.24.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150300.24.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150300.24.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150300.24.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-150300.24.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.5-5ubuntu2","3.2.5-5ubuntu3","3.2.5-5ubuntu4","3.2.5-5ubuntu4.1","3.2.5-5ubuntu4.2","3.2.5-5ubuntu4.3","3.2.5-5ubuntu4.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3-2ubuntu2","3.3-2ubuntu3","3.3-2ubuntu4","3.3-2ubuntu5","3.3-2ubuntu6","3.3-2ubuntu7","3.3-2ubuntu7.1","3.3-2ubuntu7.2","3.3-2ubuntu7.4","3.3-2ubuntu7.5","3.3-2ubuntu7.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0-2","4.0-2ubuntu1","4.0-2ubuntu1.1","4.1~rc1-3~ubuntu18.04.1","4.1~rc1-3~ubuntu18.04.2","4.1~rc1-3~ubuntu18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1-2ubuntu3","4.1-4ubuntu1","4.1-5ubuntu1","4.1-5ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mdadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2~rc2-2ubuntu1","4.2-0ubuntu1","4.2-0ubuntu2"]}],"products":[{"vendor":"mdadm_project","product":"mdadm"}],"references":[{"url":"http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00690.html","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28938","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pxxq-frx3-rf22"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-28938","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28938","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1647","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1648","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28736","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233691-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214244","tags":["report"]},{"url":"https://bugzilla.suse.com/1214245","tags":["report"]},{"url":"https://bugzilla.suse.com/1214974","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28938","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233953-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28938","tags":["report"]},{"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00690.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28938","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-28938","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T02:36:51.77Z","modified":"2024-10-02T14:28:25.413Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:32.376766Z"}],"euvd":[{"id":"EUVD-2023-32556","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T02:36:51Z","modified":"2024-10-02T14:28:25Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T00:27:59.473662Z"}],"ghsa":[{"id":"GHSA-pxxq-frx3-rf22","title":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2...","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T03:30:21Z","modified":"2024-04-04T06:51:32Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:56:45.955138Z"}],"nvd":[{"id":"CVE-2023-28938","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T03:15:27.257Z","modified":"2026-06-17T05:49:03.2Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:08:22.812138Z"}],"osv":[{"id":"AZL-27937","title":"CVE-2023-28938 affecting package mdadm for versions less than 4.1-11","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T03:15:27Z","modified":"2026-04-21T04:25:43.894601Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-34975","title":"CVE-2023-28938 affecting package mdadm for versions less than 4.2-1","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T03:15:27Z","modified":"2026-04-21T04:52:29.362662Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"BELL-CVE-2023-28938","title":"CVE-2023-28938 does not affect BellSoft software","status":"withdrawn","published":"2023-08-11T03:15:00Z","modified":"2026-01-26T09:49:04.722255Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-28938","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T03:15:27.257Z","modified":"2026-10-24T10:30:56.031675293Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-28938","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T03:15:27.257Z","modified":"2026-10-26T18:01:03.677418202Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"OESA-2023-1647","title":"mdadm security update","description":"mdadm is a tool for managing Linux Software RAID arrays. It can create, assemble, report on, and monitor arrays. It can also move spares between raid arrays when needed.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.(CVE-2023-28938)","status":"published","published":"2023-09-15T11:06:05Z","modified":"2026-08-18T01:17:02.590149038Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1648","title":"mdadm security update","description":"mdadm is a tool for managing Linux Software RAID arrays. It can create, assemble, report on, and monitor arrays. It can also move spares between raid arrays when needed.\r\n\r\nSecurity Fix(es):\r\n\r\nUncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.(CVE-2023-28938)","status":"published","published":"2023-09-15T11:06:05Z","modified":"2026-08-18T01:17:02.594997016Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1649","title":"mdadm security update","description":"mdadm is a tool for managing Linux Software RAID arrays. It can create, assemble, report on, and monitor arrays. It can also move spares between raid arrays when needed.\r\n\r\nSecurity Fix(es):\r\n\r\nBuffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.(CVE-2023-28736)\r\n\r\nUncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.(CVE-2023-28938)","status":"published","published":"2023-09-15T11:06:05Z","modified":"2026-08-18T01:17:03.612371454Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2023-28938","description":"Uncontrolled resource consumption in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a priviledged user to potentially enable denial of service via local access.","status":"published","published":"2023-08-11T03:15:00Z","modified":"2025-10-24T05:01:54Z","cvss":[{"version":"3.1","score":3.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","level":"low"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"SUSE-SU-2023:3691-1","title":"Security update for mdadm","description":"This update for mdadm fixes the following issues:\n\n- CVE-2023-28736: Fixed a buffer overflow (bsc#1214244).\n- CVE-2023-28938: Fixed uncontrolled resource consumption (bsc#1214245).\n","status":"published","published":"2023-09-19T20:05:45Z","modified":"2026-02-04T02:25:37.664729Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3953-1","title":"Security update for mdadm","description":"This update for mdadm fixes the following issues:\n\n- CVE-2023-28736: Fixed a buffer overflow (bsc#1214244).\n- CVE-2023-28938: Fixed uncontrolled resource consumption (bsc#1214245).\n","status":"published","published":"2023-10-03T18:08:42Z","modified":"2026-02-04T03:31:38.094369Z","updated_at":"2026-11-02T15:53:53.440387Z"}]}}