Execution with unnecessary privileges in nVidia products - CVE-2023-25521

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU77919

Execution with unnecessary privileges in nVidia products - CVE-2023-25521

Published: July 4, 2023 / Updated: February 9, 2024


Vulnerability identifier: #VU77919
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-25521
CWE-ID: CWE-250
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation of an input parameter in SBIOS. A local administrator can run the affected binary and execute arbitrary code on the system with root privileges.


Affected software

DGX A800 System
DGX A100 Servers
DGX Station A800
DGX Station A100
NVIDIA SBIOS

How to mitigate CVE-2023-25521

Install updates from vendor's website.

NVIDIA SBIOS - addressed in versions 1.21, 10.20
DGX A100 Servers - update to 23.06.3

External References

Related Security Bulletins