{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-45897", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-09-05T14:53:21.130Z", "dateReserved": "2023-10-16T00:00:00", "datePublished": "2023-10-28T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-11-02T20:38:59.424842"}, "descriptions": [{"lang": "en", "value": "exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/exfatprogs/exfatprogs/commit/ec78688e5fb5a70e13df82b4c0da1e6228d3ccdf"}, {"url": "https://github.com/exfatprogs/exfatprogs/releases/tag/1.2.2"}, {"url": "https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4"}, {"url": "https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae"}, {"url": "https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/exfatprogs/exfatprogs/commit/ec78688e5fb5a70e13df82b4c0da1e6228d3ccdf", "tags": ["x_transferred"]}, {"url": "https://github.com/exfatprogs/exfatprogs/releases/tag/1.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4", "tags": ["x_transferred"]}, {"url": "https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae", "tags": ["x_transferred"]}, {"url": "https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-02T18:02:59.729Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-05T14:52:59.334510Z", "id": "CVE-2023-45897", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T14:53:21.130Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/exfatprogs/exfatprogs/commit/ec78688e5fb5a70e13df82b4c0da1e6228d3ccdf", "tags": ["x_transferred"]}, {"url": "https://github.com/exfatprogs/exfatprogs/releases/tag/1.2.2", "tags": ["x_transferred"]}, {"url": "https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4", "tags": ["x_transferred"]}, {"url": "https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae", "tags": ["x_transferred"]}, {"url": "https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00003.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-09-02T18:02:59.729Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-45897", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-05T14:52:59.334510Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-05T14:53:16.525Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/exfatprogs/exfatprogs/commit/ec78688e5fb5a70e13df82b4c0da1e6228d3ccdf"}, {"url": "https://github.com/exfatprogs/exfatprogs/releases/tag/1.2.2"}, {"url": "https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4"}, {"url": "https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae"}, {"url": "https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/"}], "descriptions": [{"lang": "en", "value": "exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-11-02T20:38:59.424842"}}}, "cveMetadata": {"cveId": "CVE-2023-45897", "state": "PUBLISHED", "dateUpdated": "2024-09-05T14:53:21.130Z", "dateReserved": "2023-10-16T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-10-28T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:namjaejeon:exfatprogs:*:*:*:*:*:*:*:*", "matchCriteriaId": "43240CAA-AAC1-4A9B-926C-F1AFAB7E47EB", "versionEndExcluding": "1.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set."}, {"lang": "es", "value": "exfatprogs anteriores a 1.2.2 permiten el acceso a la memoria fuera de los l\u00edmites, como en read_file_dentry_set."}], "id": "CVE-2023-45897", "lastModified": "2023-11-21T16:33:02.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-28T21:15:07.577", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/exfatprogs/exfatprogs/commit/22d0e43e8d24119cbfc6efafabb0dec6517a86c4"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/exfatprogs/exfatprogs/commit/4abc55e976573991e6a1117bb2b3711e59da07ae"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/exfatprogs/exfatprogs/commit/ec78688e5fb5a70e13df82b4c0da1e6228d3ccdf"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://github.com/exfatprogs/exfatprogs/releases/tag/1.2.2"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:2437", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "exfatprogs-0:1.2.2-2.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-04-30T00:00:00Z"}], "bugzilla": {"description": "exfatprogs: exfatprogs allows out-of-bounds memory access", "id": "2246976", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246976"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "verified"}, "cwe": "CWE-125", "details": ["exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.", "A flaw was found in Exfatprogs, a userspace utility that contains all of the standard utilities for creating, fixing, and debugging the exfat filesystem in the linux system.This issue may allow out-of-bounds memory access such as in read_file_dentry_set. To exploit this vulnerability, the attacker must possess authorization with privileges granting basic user capabilities, and can achieve out-of-bounds memory access."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2023-45897", "public_date": "2023-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-45897\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-45897\nhttps://dfir.ru/2023/11/01/cve-2023-45897-a-vulnerability-in-the-linux-exfat-userspace-tools/"], "threat_severity": "Moderate", "upstream_fix": "exfatprogs 1.2.2"}