# CVE-2023-30630: dmidecode: Dmidecode before 3.5 allows -dump-bin to overwrite a local file

CVE-2023-30630 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2023-30630, released April 13, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-30630
- Priority: High
- CVSS: 7.1 (high)
- EPSS: 0.0051
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 13, 2023

## Description

Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for example, execution of Dmidecode via Sudo is plausible. NOTE: Some third parties have indicated the fix in 3.5 does not adequately address the vulnerability. The argument is that the proposed patch prevents dmidecode from writing to an existing file. However, there are multiple attack vectors that would not require overwriting an existing file that would provide the same level of unauthorized privilege escalation (e.g. creating a new file in /etc/cron.hourly).

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | dmidecode Debian 13.5 (trixie) | 3.5-1 | [DEBIAN-CVE-2023-30630](https://patchblox.com/security/data/fix/linux/debian-cve-2023-30630.md) | Apr 13, 2023 |
| Linux | dmidecode Debian 14 | 3.5-1 | [DEBIAN-CVE-2023-30630](https://patchblox.com/security/data/fix/linux/debian-cve-2023-30630.md) | Apr 13, 2023 |
| Linux | dmidecode RHEL 8 | 1:3.3-4.el8_8.1 | [RHSA-2023:5252](https://patchblox.com/security/data/fix/linux/rhsa-2023-5252.md) | Sep 19, 2023 |
| Linux | dmidecode RHEL 9 | 1:3.3-7.el9_2.1 | [RHSA-2023:5061](https://patchblox.com/security/data/fix/linux/rhsa-2023-5061.md) | Sep 12, 2023 |
| Linux | dmidecode almalinux 8 | 1:3.3-4.el8_8.1 | [ALSA-2023:5252](https://patchblox.com/security/data/fix/linux/alsa-2023-5252.md) | Sep 19, 2023 |
| Linux | dmidecode almalinux 9 | 1:3.3-7.el9_2.1 | [ALSA-2023:5061](https://patchblox.com/security/data/fix/linux/alsa-2023-5061.md) | Sep 12, 2023 |
| Linux | dmidecode amzn 2023 | 1:3.5-1.amzn2023.0.2 | [ALAS2023-2023-328](https://patchblox.com/security/data/fix/linux/alas2023-2023-328.md) | Aug 31, 2023 |
| Linux | dmidecode ol 8 | 1:3.3-4.el8_8.1 | [ELSA-2023-5252](https://patchblox.com/security/data/fix/linux/elsa-2023-5252.md) | Sep 20, 2023 |
| Linux | dmidecode ol 9 | 1:3.3-7.el9_2.1 | [ELSA-2023-5061](https://patchblox.com/security/data/fix/linux/elsa-2023-5061.md) | Sep 13, 2023 |
| Linux | dmidecode rocky 9 | 1:3.3-7.el9_2.1 | [RLSA-2023:5061](https://patchblox.com/security/data/fix/linux/rlsa-2023-5061.md) | Sep 26, 2023 |
| Linux | dmidecode-debuginfo amzn 2023 | 1:3.5-1.amzn2023.0.2 | [ALAS2023-2023-328](https://patchblox.com/security/data/fix/linux/alas2023-2023-328.md) | Aug 31, 2023 |
| Linux | dmidecode-debugsource amzn 2023 | 1:3.5-1.amzn2023.0.2 | [ALAS2023-2023-328](https://patchblox.com/security/data/fix/linux/alas2023-2023-328.md) | Aug 31, 2023 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.