Permissions, Privileges, and Access Controls in BlueField - CVE-2024-0106

Vulnerability identifier: #VU99497

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-0106

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to improper handling of insufficient privileges, which leads to denial of service, data tampering and limited information disclosure.

BlueField
ThinkSystem SD550 V3
ThinkAgile VX7575 Integrated System
ThinkAgile VX7820
ThinkEdge SE450
ThinkEdge SE455 V3
ThinkServer SR860P
ThinkSystem SD530
ThinkSystem SD530 V3
ThinkSystem SD535 V3
ThinkAgile VX7531 Certified Node
ThinkSystem SD630 V2
ThinkSystem SD650 DWC Dual Node Tray
ThinkSystem SD650 V2
ThinkSystem SD650-N V2
ThinkSystem SE350
ThinkSystem SN550
ThinkSystem SN550 V2
ThinkSystem SN850
ThinkAgile VX5520
ThinkAgile VX3320
ThinkAgile VX3330 Appliance
ThinkAgile VX3375 Integrated System
ThinkAgile VX3376 Certified Node
ThinkAgile VX3520-G
ThinkAgile VX3530-G Appliance
ThinkAgile VX3575-G Integrated System
ThinkAgile VX3720
ThinkSystem SR250
ThinkAgile VX5530 Appliance
ThinkAgile VX650 V2 DPU Certified Node
ThinkAgile VX7320 N
Thinkagile VX7330 Appliance
ThinkAgile VX7375-N Integrated System
ThinkAgile VX7520
ThinkAgile VX7520 N
ThinkAgile VX7530 Appliance
ThinkSystem SR860 V3
ThinkSystem SR675 V3
ThinkSystem SR680a V3
ThinkSystem SR850
ThinkSystem SR850 V2
ThinkSystem SR850 V3
ThinkSystem SR850P
ThinkSystem SR860
ThinkSystem SR860 V2
ThinkSystem SR670 V2
ThinkSystem SR950
ThinkSystem SR950 V3
ThinkSystem ST550
ThinkSystem ST558
ThinkSystem ST650 V2
ThinkSystem ST650 V3
ThinkSystem ST658 V2
ThinkSystem ST658 V3
ThinkSystem SR645 V3
ThinkSystem SR258
ThinkSystem SR630
ThinkSystem SR630 V2
ThinkSystem SR630 V3
ThinkSystem SR630 V4
ThinkSystem SR635
ThinkSystem SR635 V3
ThinkSystem SR645
ThinkAgile VX2375 Integrated System
ThinkSystem SR650
ThinkSystem SR650 V2
ThinkSystem SR650 V3
ThinkSystem SR655
ThinkSystem SR655 V3
ThinkSystem SR665
ThinkSystem SR665 V3
ThinkSystem SR670
ThinkAgile HX3321 Certified Node
ThinkAgile HX1521-R Certified Node
ThinkAgile HX2320 Appliance
ThinkAgile HX2320-E Appliance
ThinkAgile HX2321 Certified Node
ThinkAgile HX2330 Appliance
ThinkAgile HX2331 Certified Node
ThinkAgile HX2720-E Appliance
ThinkAgile HX3320 Appliance
ThinkAgile HX1520-R Appliance
ThinkAgile HX3330 Appliance
ThinkAgile HX3331 Certified Node
ThinkAgile HX3520-G Appliance
ThinkAgile HX3521-G Certified Node
ThinkAgile HX3720 Appliance
ThinkAgile HX3721 Certified Node
ThinkAgile HX5520 Appliance
ThinkAgile HX5520-C Appliance
System x3850 X6
Flex Compute Node - x240 M5
Flex Compute Node - x280 X6
Flex Compute Node - x480 X6
Flex Compute Node - x880 X6
System x3500 M5
System x3550 M5
System x3650 M5
System x3750 M4
ThinkAgile HX5521 Certified Node
System x3950 X6
ThinkAgile HX5530 Appliance
ThinkAgile HX7530 Appliance
ThinkAgile VX3331 Certified Node
ThinkAgile HX1320 Appliance
ThinkAgile HX1321 Certified Node
ThinkAgile HX1330 Appliance
ThinkAgile HX1331 Certified Node
ThinkAgile MX1021 on SE350
ThinkAgile MX3531-F All-flash Certified node
ThinkAgile MX630 V3 Certified Node
ThinkAgile MX630 V3 Integrated System
ThinkAgile MX650 V3 Certified Node
ThinkAgile MX650 v3 Integrated System
ThinkAgile MX650 V3 Premier System
ThinkAgile MX Certified Node – All Flash
ThinkAgile MX Certified Node – Hybrid
ThinkAgile MX3531 H Hybrid Certified node
ThinkAgile VX 1SE Certified Node
ThinkAgile VX 1U Certified Node
ThinkAgile VX 2U Certified Node
ThinkAgile VX 2U4N Certified Node
ThinkAgile VX 4U Certified Node
ThinkAgile VX1320
ThinkAgile VX2320
ThinkAgile VX2330 Appliance
ThinkAgile MX3330-F All-flash Appliance
ThinkAgile HX5521-C Certified Node
ThinkAgile HX5531 Certified Node
ThinkAgile HX7520 Appliance
ThinkAgile HX7521 Certified Node
ThinkAgile HX7531 Certified Node
ThinkAgile HX7820 Appliance
ThinkAgile HX7821 Certified Node
ThinkAgile MX Edge Appliance - MX1020
NeXtScale Compute Node - nx360 M5
ThinkAgile MX3330-H Hybrid Appliance
ThinkAgile MX3331-F All-flash Certified node
ThinkAgile MX3331-H Hybrid Certified node
ThinkAgile MX3520 F Appliance - All flash
ThinkAgile MX3520 H Appliance - Hybrid
ThinkAgile MX3530 F All flash Appliance
ThinkAgile MX3530-H Hybrid Appliance
Nvidia-Mellanox ConnectX Networking Adapter/Device Windows Driver
Nvidia-Mellanox ConnectX Networking Adapter/Device Windows Firmware
Nvidia-Mellanox ConnectX Networking Adapter/Device Linux Firmware
Nvidia-Mellanox ConnectX Networking Adapter/Device VMware Driver

Install updates from vendor's website.

BlueField - addressed in versions xx.35.4030, xx.39.3560, xx.41.1000, 18.31.1014
Nvidia-Mellanox ConnectX Networking Adapter/Device Windows Driver - update to 43
Nvidia-Mellanox ConnectX Networking Adapter/Device Windows Firmware - update to 43
Nvidia-Mellanox ConnectX Networking Adapter/Device Linux Firmware - update to 43
Nvidia-Mellanox ConnectX Networking Adapter/Device VMware Driver - update to 43

• https://nvidia.custhelp.com/app/answers/detail/a_id/5562

• Multiple vulnerabilities in NVIDIA ConnectX and BlueField
• Lenovo update for NVIDIA ConnectX