Lucene search

NvidiaCVE-2022-42278

HistoryJan 13, 2023 - 2:15 a.m.

CVE-2022-42278

2023-01-1302:15:08

CWE-119

nvidia

web.nvd.nist.gov

nvidia

bmc

spx

rest api

vulnerability

unauthorized access

memory

code execution

denial of service

information disclosure

data tampering

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

12.6%

JSON

NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the IPMI server process, which may lead to code execution, denial of service, information disclosure and data tampering.

Affected configurations

Nvd

Node

nvidiadgx_a100Match-

AND

nvidiabmcRange<00.19.07

VendorProductVersionCPE
nvidiadgx_a100-cpe:2.3:h:nvidia:dgx_a100:-:*:*:*:*:*:*:*
nvidiabmc*cpe:2.3:o:nvidia:bmc:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nvidia	dgx_a100	-	cpe:2.3:h:nvidia:dgx_a100:-:::::::*
nvidia	bmc	*	cpe:2.3:o:nvidia:bmc::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NVIDIA DGX servers",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All BMC firmware versions prior to 00.19.07"
      }
    ]
  }
]

References

nvidia.custhelp.com/app/answers/detail/a_id/5435

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2022-42278