Lucene search

NvidiaCVELIST:CVE-2023-0209

HistoryApr 22, 2023 - 2:28 a.m.

CVE-2023-0209

2023-04-2202:28:54

CWE-287

nvidia

www.cve.org

nvidia

dgx-1

sbios

vulnerability

uncore pei module

authentication

code execution

denial of service

escalation of privileges

firmware implant

information disclosure

data tampering

secureboot bypass

cve-2023-0209

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware implant, data tampering, and SecureBoot bypass.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NVIDIA DGX servers",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "All SBIOS prior to S2W_3A13"
      }
    ]
  }
]

References

nvidia.custhelp.com/app/answers/detail/a_id/5458

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

Related for CVELIST:CVE-2023-0209