SB2022060813 - Multiple vulnerabilities in NVIDIA DGX A100
Published: June 8, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2022-28200)
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in SBIOS in the BiosCfgTool. A local administrator can trigger out-of-bounds write and execute arbitrary code on the target system with elevated privileges.
2) Access of Uninitialized Pointer (CVE-ID: CVE-2022-31599)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to access of uninitialized pointer in SBIOS in the Ofbd. A local administrator can execute arbitrary code on the target system.
3) Integer overflow (CVE-ID: CVE-2022-31600)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in SBIOS in the SmmCore. A local administrator can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Out-of-bounds write (CVE-ID: CVE-2022-31601)
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to a boundary error in SBIOS in the SmbiosPei. A local administrator can trigger out-of-bounds write and execute arbitrary code on the target system with elevated privileges.
5) Out-of-bounds write (CVE-ID: CVE-2022-31602)
The vulnerability allows a local use to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in SBIOS in the IpSecDxe. A local administrator can trigger out-of-bounds write and execute arbitrary code on the target system with elevated privileges.
6) Improper Validation of Array Index (CVE-ID: CVE-2022-31603)
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to a improper validation of array index in SBIOS in the IpSecDxe. A local administrator can execute arbitrary code on the target system with elevated privileges.
Remediation
Install update from vendor's website.