CVE-Katalog

CVE-2023-28736

mdadm affected and fixed versions

[CVE-Katalog]

Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalation of privilege via local access.

Schweregrad
Medium · CVSS 5.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiemdadm4.2-1FixedDistribution-reported fixed boundary[CVE-2023-28736]
Debiantrixiemdadm4.4-11Fixed[CVE-2023-28736]
Debiansidmdadm4.2-1FixedDistribution-reported fixed boundary[CVE-2023-28736]
Debiansidmdadm4.6-3Fixed[CVE-2023-28736]
Debianforkymdadm4.2-1FixedDistribution-reported fixed boundary[CVE-2023-28736]
Debianforkymdadm4.6-3Fixed[CVE-2023-28736]
Debianbookwormmdadm4.2-1FixedDistribution-reported fixed boundary[CVE-2023-28736]
Debianbookwormmdadm4.2-5Fixed[CVE-2023-28736]

Showing 8 fix observations. All 50 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedmdadm4.2-1UnknownSource applicability is not establishedProvider not reported
Debianbookwormmdadm4.2-1FixedDistribution-reported fixed boundary[CVE-2023-28736]
Debianbookwormmdadm4.2-5Fixed[CVE-2023-28736]
Debianforkymdadm4.2-1FixedDistribution-reported fixed boundary[CVE-2023-28736]
Debianforkymdadm4.6-3Fixed[CVE-2023-28736]
Debiansidmdadm4.2-1FixedDistribution-reported fixed boundary[CVE-2023-28736]
Debiansidmdadm4.6-3Fixed[CVE-2023-28736]
Debiantrixiemdadm4.2-1FixedDistribution-reported fixed boundary[CVE-2023-28736]
Debiantrixiemdadm4.4-11Fixed[CVE-2023-28736]
Opensuseleap 15.4mdadm4.1-150300.24.33.1UnknownSource applicability is not established[SUSE-SU-2023:3953-1]
Suselinux enterprise micro 5.1mdadm4.1-150300.24.33.1UnknownSource applicability is not established[SUSE-SU-2023:3953-1]
Suselinux enterprise micro 5.2mdadm4.1-150300.24.33.1UnknownSource applicability is not established[SUSE-SU-2023:3953-1]
Suselinux enterprise micro 5.3mdadm4.1-150300.24.33.1UnknownSource applicability is not established[SUSE-SU-2023:3953-1]
Suselinux enterprise micro 5.4mdadm4.1-150300.24.33.1UnknownSource applicability is not established[SUSE-SU-2023:3953-1]
Suselinux enterprise module for basesystem 15 sp4mdadm4.1-150300.24.33.1UnknownSource applicability is not established[SUSE-SU-2023:3953-1]
Suselinux enterprise server 12 sp5mdadm4.1-4.29.1UnknownSource applicability is not established[SUSE-SU-2023:3691-1]
Suselinux enterprise server for sap applications 12 sp5mdadm4.1-4.29.1UnknownSource applicability is not established[SUSE-SU-2023:3691-1]
Susemanager proxy 4.2mdadm4.1-150300.24.33.1UnknownSource applicability is not established[SUSE-SU-2023:3953-1]
Susemanager server 4.2mdadm4.1-150300.24.33.1UnknownSource applicability is not established[SUSE-SU-2023:3953-1]
Ubuntu14.04mdadm3.2.5-5ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu14.04mdadm3.2.5-5ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu14.04mdadm3.2.5-5ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu14.04mdadm3.2.5-5ubuntu4.1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu14.04mdadm3.2.5-5ubuntu4.2UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu14.04mdadm3.2.5-5ubuntu4.3UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu14.04mdadm3.2.5-5ubuntu4.4UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu5UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu6UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu7UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu7.1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu7.2UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu7.4UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu7.5UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu16.04mdadm3.3-2ubuntu7.6UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu18.04mdadm4.0-2UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu18.04mdadm4.0-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu18.04mdadm4.0-2ubuntu1.1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu18.04mdadm4.1~rc1-3~ubuntu18.04.1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu18.04mdadm4.1~rc1-3~ubuntu18.04.2UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu18.04mdadm4.1~rc1-3~ubuntu18.04.4UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu20.04mdadm4.1-2ubuntu3UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu20.04mdadm4.1-4ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu20.04mdadm4.1-5ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu20.04mdadm4.1-5ubuntu1.2UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu22.04mdadm4.2-0ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu22.04mdadm4.2-0ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Ubuntu22.04mdadm4.2~rc2-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-28736]
Original provider fields
{
  "package_releases": [
    {
      "name": "mdadm",
      "status": "fixed",
      "release": "sid",
      "version": "4.6-3"
    },
    {
      "name": "mdadm",
      "status": "fixed",
      "release": "forky",
      "version": "4.6-3"
    },
    {
      "name": "mdadm",
      "status": "fixed",
      "release": "trixie",
      "version": "4.4-11"
    },
    {
      "name": "mdadm",
      "status": "fixed",
      "release": "bookworm",
      "version": "4.2-5"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "mdadm",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "4.2-1"
    },
    {
      "bug": null,
      "name": "mdadm",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "4.2-1"
    },
    {
      "bug": null,
      "name": "mdadm",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "4.2-1"
    },
    {
      "bug": null,
      "name": "mdadm",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "4.2-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "mdadm",
      "fixed_version": "4.2-1",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-150300.24.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3953-1",
      "fixed_version": "4.1-150300.24.33.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3953-1",
      "provider_updated_at": "2026-02-04T03:31:38.094369Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-150300.24.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3953-1",
      "fixed_version": "4.1-150300.24.33.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3953-1",
      "provider_updated_at": "2026-02-04T03:31:38.094369Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-150300.24.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3953-1",
      "fixed_version": "4.1-150300.24.33.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3953-1",
      "provider_updated_at": "2026-02-04T03:31:38.094369Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-150300.24.33.1"
            }
          ]
        }
      ],
      "release": "manager proxy 4.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3953-1",
      "fixed_version": "4.1-150300.24.33.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3953-1",
      "provider_updated_at": "2026-02-04T03:31:38.094369Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-150300.24.33.1"
            }
          ]
        }
      ],
      "release": "manager server 4.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3953-1",
      "fixed_version": "4.1-150300.24.33.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3953-1",
      "provider_updated_at": "2026-02-04T03:31:38.094369Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-150300.24.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3953-1",
      "fixed_version": "4.1-150300.24.33.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3953-1",
      "provider_updated_at": "2026-02-04T03:31:38.094369Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-150300.24.33.1"
            }
          ]
        }
      ],
      "release": "linux enterprise micro 5.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3953-1",
      "fixed_version": "4.1-150300.24.33.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3953-1",
      "provider_updated_at": "2026-02-04T03:31:38.094369Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-150300.24.33.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3953-1",
      "fixed_version": "4.1-150300.24.33.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3953-1",
      "provider_updated_at": "2026-02-04T03:31:38.094369Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-4.29.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3691-1",
      "fixed_version": "4.1-4.29.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3691-1",
      "provider_updated_at": "2026-02-04T02:25:37.664729Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1-4.29.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:3691-1",
      "fixed_version": "4.1-4.29.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:3691-1",
      "provider_updated_at": "2026-02-04T02:25:37.664729Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "3.2.5-5ubuntu2",
        "3.2.5-5ubuntu3",
        "3.2.5-5ubuntu4",
        "3.2.5-5ubuntu4.1",
        "3.2.5-5ubuntu4.2",
        "3.2.5-5ubuntu4.3",
        "3.2.5-5ubuntu4.4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-28736",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-28736",
      "provider_updated_at": "2025-10-24T05:01:54Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "3.3-2ubuntu2",
        "3.3-2ubuntu3",
        "3.3-2ubuntu4",
        "3.3-2ubuntu5",
        "3.3-2ubuntu6",
        "3.3-2ubuntu7",
        "3.3-2ubuntu7.1",
        "3.3-2ubuntu7.2",
        "3.3-2ubuntu7.4",
        "3.3-2ubuntu7.5",
        "3.3-2ubuntu7.6"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-28736",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-28736",
      "provider_updated_at": "2025-10-24T05:01:54Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "4.0-2",
        "4.0-2ubuntu1",
        "4.0-2ubuntu1.1",
        "4.1~rc1-3~ubuntu18.04.1",
        "4.1~rc1-3~ubuntu18.04.2",
        "4.1~rc1-3~ubuntu18.04.4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-28736",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-28736",
      "provider_updated_at": "2025-10-24T05:01:54Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "4.1-2ubuntu3",
        "4.1-4ubuntu1",
        "4.1-5ubuntu1",
        "4.1-5ubuntu1.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-28736",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-28736",
      "provider_updated_at": "2025-10-24T05:01:54Z",
      "applicability_unknown": true
    },
    {
      "name": "mdadm",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "4.2~rc2-2ubuntu1",
        "4.2-0ubuntu1",
        "4.2-0ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-28736",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-28736",
      "provider_updated_at": "2025-10-24T05:01:54Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Die Paketzuordnung läuft.

[Debian 12 (Bookworm)]

  • [mdadm]Unbekannt
    Details (2)

    • 4.2-5 · amd64 · bookworm

      Behoben · Behoben: 4.2-1

      dsa · mdadm · debian · bookworm; dsa · mdadm · debian · 12

    • 4.2-5 · arm64 · bookworm

      Behoben · Behoben: 4.2-1

      dsa · mdadm · debian · bookworm; dsa · mdadm · debian · 12

[Debian 13 (Trixie)]

  • [mdadm]Unbekannt
    Details (2)

    • 4.4-11 · amd64 · trixie

      Behoben · Behoben: 4.2-1

      dsa · mdadm · debian · 13

    • 4.4-11 · arm64 · trixie

      Behoben · Behoben: 4.2-1

      dsa · mdadm · debian · 13

Beobachtet:

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]