CVE-2023-23583: debian debian_linux
Vulnerability summary
CVE-2023-23583 is a high (CVSS 8.8) vulnerability in debian debian_linux. EPSS estimates a 1.28% chance of exploitation in the next 30 days, higher than 70.1% of scored vulnerabilities.
Not severe (CVSS 8.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 14-11-2023PublishedVulnerability first disclosed.
- 16-12-2025Last modifiedVulnerability information updated.
Description
Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.28%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
Decrease -0.45 pp
From 1.73% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1281Sequence of Processor Instructions Leads to Unexpected BehaviorSpecific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed.
- CWE-276Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Intel196 products
- core_i3-1005g1_firmwarena
- core_i3-10100y_firmwarena
- core_i3-10110u_firmwarena
- core_i3-10110y_firmwarena
- core_i3-11100he_firmwarena
Debian2 products
- intel-microcode< 3.20231114.1~deb11u1 | < 3.20231114.1~deb10u1 | < 3.20231114.1~deb12u1 | < 3.20231114.1
- debian_linuxEOL11.0 | 12.0
Alpine1 product
- intel-ucode< 20231114-r0
Ubuntu1 product
- intel-microcodeAll versions (No fix recorded) | < 3.20231114.0ubuntu0.16.04.1+esm1 | < 3.20231114.0ubuntu0.18.04.1+esm1 | < 3.20231114.0ubuntu0.20.04.1 | < 3.20231114.0ubuntu0.22.04.1
4 vendors · 200 products · Showing 200 of 254
References
29 links- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.htmlAdvisoryREPORTVendor Advisory
- www.openwall.com/lists/oss-security/2023/11/14/8Mailing List
- www.openwall.com/lists/oss-security/2023/11/14/9Mailing List
- security.netapp.com/advisory/ntap-20231116-0015/Third Party Advisory
www.debian.org/security/2023/dsa-5563Third Party Advisory
Show all 29 references
- www.intel.com/content/…REPORT