Lucene search

NvidiaCVE-2022-42277

HistoryJan 13, 2023 - 2:15 a.m.

CVE-2022-42277

2023-01-1302:15:07

CWE-306

CWE-288

nvidia

web.nvd.nist.gov

nvidia

dgx station

sbios

smiflash

vulnerability

cve-2022-42277

code execution

privilege escalation

denial of service

information disclosure

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

25.6%

JSON

NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.

Affected configurations

Nvd

Node

nvidiadgx_station_a100_firmwareRange<10.16sbios

AND

nvidiadgx_station_a100Match-

VendorProductVersionCPE
nvidiadgx_station_a100_firmware*cpe:2.3:o:nvidia:dgx_station_a100_firmware:*:*:*:*:sbios:*:*:*
nvidiadgx_station_a100-cpe:2.3:h:nvidia:dgx_station_a100:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nvidia	dgx_station_a100_firmware	*	cpe:2.3:o:nvidia:dgx_station_a100_firmware:::::sbios:::*
nvidia	dgx_station_a100	-	cpe:2.3:h:nvidia:dgx_station_a100:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NVIDIA DGX servers",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All SBIOS firmware versions prior to 10.16"
      }
    ]
  }
]

References

nvidia.custhelp.com/app/answers/detail/a_id/5435

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

25.6%

JSON

Related for CVE-2022-42277