PT-2022-4514 · Nvidia · Nvidia Dgx A100

Published 2022-06-07 · Updated 2022-07-13 · CVE-2022-31603

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA DGX A100 (affected versions not specified)

Description The issue is related to a vulnerability in the SBIOS component of the IpSecDxe in NVIDIA DGX A100 servers. This vulnerability is caused by improper validation of an array index. A user with high privileges and preconditioned IpSecDxe global data can exploit this vulnerability to cause code execution, potentially leading to denial of service, data integrity impact, and information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

BDU:2022-05382

CVE-2022-31603

Affected Products

Nvidia Dgx A100

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-31603 · Security Note
• https://bdu.fstec.ru/vul/2022-05382 · Security Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5367 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31603 · Vendor Advisory
• https://t.me/cvenotify/32576 · Telegram Post