PT-2022-4516 · Nvidia · Nvidia Dgx A100

Published 2022-06-07 · Updated 2022-07-13 · CVE-2022-31600

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA DGX A100 (affected versions not specified)

Description The issue is caused by an integer overflow in the SBIOS component of the SmmCore server. This could allow an attacker to execute arbitrary code, cause a denial of service, and impact the confidentiality and integrity of protected information. A user with high privileges can chain another vulnerability to this issue, potentially leading to code execution, escalation of privileges, and compromised integrity. The scope of impact may extend to other components.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2022-05384

CVE-2022-31600

Affected Products

Nvidia Dgx A100

References · 5

• https://osv.dev/vulnerability/CVE-2022-31600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31600 · Security Note
• https://bdu.fstec.ru/vul/2022-05384 · Security Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5367 · Vendor Advisory
• https://t.me/cvenotify/32579 · Telegram Post