Lucene search

[email protected]CVE-2022-42268

HistoryJan 13, 2023 - 6:15 a.m.

CVE-2022-42268

2023-01-1306:15:11

CWE-94

CWE-74

[email protected]

web.nvd.nist.gov

cve-2022-42268

omniverse kit

vulnerability

python code

usd files

information disclosure

data tampering

denial of service

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow executable Python code to be embedded in Universal Scene Description (USD) files to customize all aspects of a scene. If a user opens a USD file that contains embedded Python code in one of these applications, the embedded Python code automatically runs with the privileges of the user who opened the file. As a result, an unprivileged remote attacker could craft a USD file containing malicious Python code and persuade a local user to open the file, which may lead to information disclosure, data tampering, and denial of service.

Affected configurations

NVD

Node

nvidianvidia_isaac_simRange<2022.2.0

nvidiaomniverse_audio2faceRange<2022.2

nvidiaomniverse_codeRange<2022.3.0

nvidiaomniverse_createRange<2022.3

nvidiaomniverse_machinimaRange<2022.3

nvidiaomniverse_viewRange<2022.2.1

CPENameOperatorVersion
nvidia:nvidia_isaac_simnvidia nvidia isaac simlt2022.2.0
nvidia:omniverse_audio2facenvidia omniverse audio2facelt2022.2
nvidia:omniverse_codenvidia omniverse codelt2022.3.0
nvidia:omniverse_createnvidia omniverse createlt2022.3
nvidia:omniverse_machinimanvidia omniverse machinimalt2022.3
nvidia:omniverse_viewnvidia omniverse viewlt2022.2.1

CPE	Name	Operator	Version
nvidia:nvidia_isaac_sim	nvidia nvidia isaac sim	lt	2022.2.0
nvidia:omniverse_audio2face	nvidia omniverse audio2face	lt	2022.2
nvidia:omniverse_code	nvidia omniverse code	lt	2022.3.0
nvidia:omniverse_create	nvidia omniverse create	lt	2022.3
nvidia:omniverse_machinima	nvidia omniverse machinima	lt	2022.3
nvidia:omniverse_view	nvidia omniverse view	lt	2022.2.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Omniverse Audio2Face",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 2022.2"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Omniverse Create",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 2022.3"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NVIDIA Isaac Sim",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 2022.2.0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Omniverse Machinima",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 2022.3"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Omniverse Code",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 2022.3.0"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Omniverse View",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to 2022.2.1"
      }
    ]
  }
]

References

nvidia.custhelp.com/app/answers/detail/a_id/5418

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.8%

JSON

Related for CVE-2022-42268

cvelist1 prion1 nvd1 nvidia1