PT-2023-20139 · Nvidia · Nvidia Dgx H100 Bmc

Published 2023-09-19 · Updated 2024-01-25 · CVE-2023-25529

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA DGX H100 BMC (affected versions not specified) NVIDIA DGX A100 BMC (affected versions not specified)

Description The vulnerability is located in the host KVM daemon of the NVIDIA DGX H100 BMC and DGX A100 BMC, where an unauthenticated attacker may cause a leak of another user’s session token by observing timing discrepancies between server responses. A successful exploit of this issue may lead to information disclosure, escalation of privileges, and data tampering.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Side Channel Attack

Weakness Enumeration

CWE-208

CWE-203

Related Identifiers

CVE-2023-25529

Affected Products

Nvidia Dgx H100 Bmc

References · 12

• https://osv.dev/vulnerability/CVE-2023-25529 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25529 · Security Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5473 · Vendor Advisory
• https://twitter.com/CVEnew/status/1704299963960701391 · Twitter Post
• https://t.me/cvenotify/58123 · Telegram Post
• https://nvidia.custhelp.com/app/answers/detail/a_id/5510 · Note
• https://t.me/cvenotify/68716 · Telegram Post
• https://t.me/cibsecurity/70754 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1704372350165098668 · Twitter Post
• https://t.me/cvenotify/58122 · Telegram Post
• https://twitter.com/DMFezzaReedCISA/status/1704363966435086498 · Twitter Post
• https://twitter.com/cracbot/status/1704737263505314154 · Twitter Post