CVE-2023-23908

Name: CVE-2023-23908
Creator: NVD / NIST
Published: 2023-08-11T03:15:18.51+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.4/10EPSS 0.31%

Last modified Jun 17, 2026

CVE-2023-23908 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access.. EPSS estimates a 0.31% chance of exploitation in the next 30 days.

Description

Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access.

Metrics

CVSS 3.1

4.4/10

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

0.31%

22.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-284

Affected Software

Vendor	Product	Versions
Intel	Microcode	< 20230808
Debian	Debian Linux	10.0
Debian	Debian Linux	11.0
Debian	Debian Linux	12.0
Fedoraproject	Fedora	37
Fedoraproject	Fedora	38
Intel	Xeon D-2745nx Firmware	All versions
Intel	Xeon D-2757nx Firmware	All versions
Intel	Xeon D-2777nx Firmware	All versions
Intel	Xeon D-2798nx Firmware	All versions
Intel	Xeon D-1702 Firmware	All versions
Intel	Xeon D-1712tr Firmware	All versions
Intel	Xeon D-1713nt Firmware	All versions
Intel	Xeon D-1713nte Firmware	All versions
Intel	Xeon D-1714 Firmware	All versions
Intel	Xeon D-1715ter Firmware	All versions
Intel	Xeon D-1718t Firmware	All versions
Intel	Xeon D-1722ne Firmware	All versions
Intel	Xeon D-1726 Firmware	All versions
Intel	Xeon D-1732te Firmware	All versions
Intel	Xeon D-1733nt Firmware	All versions
Intel	Xeon D-1734nt Firmware	All versions
Intel	Xeon D-1735tr Firmware	All versions
Intel	Xeon D-1736 Firmware	All versions
Intel	Xeon D-1736nt Firmware	All versions
Intel	Xeon D-1739 Firmware	All versions
Intel	Xeon D-1746ter Firmware	All versions
Intel	Xeon D-1747nte Firmware	All versions
Intel	Xeon D-1748te Firmware	All versions
Intel	Xeon D-1749nt Firmware	All versions
Intel	Xeon D-2712t Firmware	All versions
Intel	Xeon D-2733nt Firmware	All versions
Intel	Xeon D-2738 Firmware	All versions
Intel	Xeon D-2752nte Firmware	All versions
Intel	Xeon D-2752ter Firmware	All versions
Intel	Xeon D-2753nt Firmware	All versions
Intel	Xeon D-2766nt Firmware	All versions
Intel	Xeon D-2775te Firmware	All versions
Intel	Xeon D-2776nt Firmware	All versions
Intel	Xeon D-2779 Firmware	All versions
Intel	Xeon D-2786nte Firmware	All versions
Intel	Xeon D-2795nt Firmware	All versions
Intel	Xeon D-2796nt Firmware	All versions
Intel	Xeon D-2796te Firmware	All versions
Intel	Xeon D-2798nt Firmware	All versions
Intel	Xeon D-2799 Firmware	All versions
Intel	Xeon D-1602 Firmware	All versions
Intel	Xeon D-1622 Firmware	All versions
Intel	Xeon D-1623n Firmware	All versions
Intel	Xeon D-1627 Firmware	All versions

Showing 50 of 142 affected configurations. See NVD for the full list.

References

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00026.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKREYYTWUY7ZDNIB2N6H5BUJ3LE5VZPE/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OL7WI2TJCWSZIQP2RIOLWHOKLM25M44J/Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230824-0003/
https://www.debian.org/security/2023/dsa-5474Third Party Advisory
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00836.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2023/08/msg00026.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HKREYYTWUY7ZDNIB2N6H5BUJ3LE5VZPE/Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OL7WI2TJCWSZIQP2RIOLWHOKLM25M44J/Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20230824-0003/
https://www.debian.org/security/2023/dsa-5474Third Party Advisory

Timeline

Published: Aug 11, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-23908?

Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access.

How severe is CVE-2023-23908?

CVE-2023-23908 has a CVSS score of 4.4/10 (MEDIUM severity). The EPSS model estimates a 0.31% probability of exploitation in the next 30 days.

How do I fix CVE-2023-23908?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-23908?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST