Main Vulnerability Database Vulnerabilities #VU77920

Input validation error in nVidia products - CVE-2023-25522

Published: July 4, 2023

Vulnerability identifier: #VU77920

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-25522

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the target system.

The vulnerability exists due to insufficient validation of user-supplied input in SBIOS. A local administrator can pass specially crafted input to the application and execute arbitrary code on the system with root privileges.

Affected software

DGX A800 System
DGX A100 Servers
NVIDIA SBIOS

How to mitigate CVE-2023-25522

Install updates from vendor's website.

NVIDIA SBIOS - update to 1.21
DGX A100 Servers - update to 23.06.3

External References

https://nvidia.custhelp.com/app/answers/detail/a_id/5461

Related Security Bulletins