PT-2022-15155 · Nvidia+1 · Nvidia Cuda Toolkit+1

Leonardo Galli · Published 2022-03-29 · Updated 2022-04-08 · CVE-2022-21821

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA CUDA Toolkit SDK (affected versions not specified)

Description The issue is related to an integer overflow vulnerability in the cuobjdump component. To exploit this, a remote attacker would need a local user to download a specially crafted, corrupted file and then execute cuobjdump against it locally. This could lead to remote code execution, resulting in a complete denial of service and impacting data confidentiality and integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Integer Overflow

Weakness Enumeration

CWE-190

CWE-1285

Related Identifiers

CVE-2022-21821

Affected Products

Debian

Nvidia Cuda Toolkit

References · 9

• https://ubuntu.com/security/CVE-2022-21821 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-21821 · Security Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5334 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21821 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-21821 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-21821 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21821 · Vendor Advisory
• https://t.me/cibsecurity/39778 · Telegram Post