TI-2023-24600 Aliases CVE-2023-45840 GHSA-wrw9-r95r-fm43

Multiple data integrity vulnerabilities exist in the package hash checking functionality…

LOW 37CWE-494Published 2023-12-05 · Updated 2025-11-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-494.

Summary

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `riscv64-elf-toolchain` package.

Why it matters now

EPSS 0.0081 57th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Buildroot	Buildroot	2023.08.1; dev commit 622698d7847	—	No fix listed	CNA

Buildroot VendorBuildroot Affected 2023.08.1; dev commit 622698d7847 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:buildroot:buildroot:2023.08.1:::::::*	2023.08.1	Vulnerable	Buildroot

cpe:2.3:a:buildroot:buildroot:2023.08.1:*:*:*:*:*:*:* Versions 2023.08.1 Vulnerable ·Buildroot

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-45840
2026-10-03 Alias added: GHSA-wrw9-r95r-fm43

References

Exploit 1

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844

Advisory 1

http://www.openwall.com/lists/oss-security/2023/12/11/1

TI-2023-24602 Multiple data integrity vulnerabilities exist in the package hash checking functionality… CVSS 3.1HIGH 8.1
TI-2023-24601 Multiple data integrity vulnerabilities exist in the package hash checking functionality… CVSS 3.1HIGH 8.1
TI-2023-24599 Multiple data integrity vulnerabilities exist in the package hash checking functionality… CVSS 3.1HIGH 8.1
TI-2023-24598 Multiple data integrity vulnerabilities exist in the package hash checking functionality… CVSS 3.1HIGH 8.1
TI-2023-23337 A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of… CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences