PT-2022-15156 · Nvidia · Nvidia Flare

Nintorac · Published 2022-03-17 · Updated 2022-06-15 · CVE-2022-21822

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA FLARE versions prior to 2.0.16

Description The issue is related to the admin interface of NVIDIA FLARE, where an unauthorized attacker can cause allocation of resources without limits or throttling, potentially leading to system unavailability.

Recommendations For versions prior to 2.0.16, update to version 2.0.16 to resolve the issue. As a temporary workaround, apply the changes in commits https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e to any version of NVIDIA FLARE without adverse effects.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-21822

GHSA-JX8F-CPX7-FV47

Affected Products

Nvidia Flare

References · 6

• https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-jx8f-cpx7-fv47 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21822 · Security Note
• https://osv.dev/vulnerability/GHSA-jx8f-cpx7-fv47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21822 · Vendor Advisory
• https://github.com/NVIDIA/NVFlare · Note
• https://t.me/cibsecurity/39175 · Telegram Post