What’s Vulnerable › Vulnerabilities

CVE-2023-23908

• Severity: medium (CVSS 4.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-11 · updated 2026-06-17
• Weakness: CWE-284

Description

Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access.

Affected products

• Debian Linux: 10.0, 11.0, 12.0
• Fedoraproject Fedora: 37, 38
• Intel Microcode: before 20230808 — fixed in 20230808
• Intel Xeon D-1513N Firmware: all versions
• Intel Xeon D-1518 Firmware: all versions
• Intel Xeon D-1520 Firmware: all versions
• Intel Xeon D-1521 Firmware: all versions
• Intel Xeon D-1523N Firmware: all versions
• Intel Xeon D-1527 Firmware: all versions
• Intel Xeon D-1528 Firmware: all versions
• Intel Xeon D-1529 Firmware: all versions
• Intel Xeon D-1531 Firmware: all versions
• Intel Xeon D-1533N Firmware: all versions
• Intel Xeon D-1537 Firmware: all versions
• Intel Xeon D-1539 Firmware: all versions
• Intel Xeon D-1540 Firmware: all versions
• Intel Xeon D-1541 Firmware: all versions
• Intel Xeon D-1543N Firmware: all versions
• Intel Xeon D-1548 Firmware: all versions
• Intel Xeon D-1553N Firmware: all versions
• Intel Xeon D-1557 Firmware: all versions
• Intel Xeon D-1559 Firmware: all versions
• Intel Xeon D-1567 Firmware: all versions
• Intel Xeon D-1571 Firmware: all versions
• Intel Xeon D-1577 Firmware: all versions
• Intel Xeon D-1602 Firmware: all versions
• Intel Xeon D-1622 Firmware: all versions
• Intel Xeon D-1623N Firmware: all versions
• Intel Xeon D-1627 Firmware: all versions
• Intel Xeon D-1633N Firmware: all versions

How to fix

Upgrade to a fixed version: Intel Microcode 20230808. Check the vendor advisory for mitigations.

References

• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html
• https://lists.debian.org/debian-lts-announce/2023/08/msg00026.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKREYYTWUY7ZDNIB2N6H5BUJ3LE5VZPE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OL7WI2TJCWSZIQP2RIOLWHOKLM25M44J/
• https://security.netapp.com/advisory/ntap-20230824-0003/
• https://www.debian.org/security/2023/dsa-5474
• http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.html
• https://lists.debian.org/debian-lts-announce/2023/08/msg00026.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKREYYTWUY7ZDNIB2N6H5BUJ3LE5VZPE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OL7WI2TJCWSZIQP2RIOLWHOKLM25M44J/
• https://security.netapp.com/advisory/ntap-20230824-0003/
• https://www.debian.org/security/2023/dsa-5474

Get alerted when CVE-2023-23908 or the next vulnerability affects your stack