CVE-2023-25508

NVIDIA DGX-1 BMC IPMI handler vulnerability (CVE-2023-25508) allows an attacker with the appropriate authorization level to upload/download arbitrary files under certain circumstances, potentially causing denial of service, privilege escalation, information disclosure, and data tampering. The iss...

CVE-2023-25507

The CVE-2023-25507 issue affects NVIDIA DGX-1 BMC SPX REST API. A privileged, authenticated attacker can inject arbitrary shell commands via the REST API, potentially enabling code execution, denial of service, information disclosure, or data tampering. Public sources corroborate affecting DGX-1 ...

CVE-2023-25507

NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering...

CVE-2023-25507

NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering...

CVE-2023-25506

NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the end of a buffer, which may lead to code execution, escalation of privileges, denial of service and information disclosure. The scope of t...

CVE-2023-25506

NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the end of a buffer, which may lead to code execution, escalation of privileges, denial of service and information disclosure. The scope of t...

CVE-2023-25506

CVE-2023-25506 affects NVIDIA DGX-1 firmware (Ofbd in AMI SBIOS). The root cause is a preconditioned heap that can allow a user with elevated privileges to access beyond the end of a buffer, enabling code execution, privilege escalation, DoS, and information disclosure. Output from Red Hat and NV...

CVE-2023-25505

CVE-2023-25505 affects NVIDIA DGX-1 BMC, specifically the IPMI handler in the AMI MegaRAC BMC. The issue is a buffer overflow that an attacker with the appropriate authorization level can trigger, potentially causing denial of service, information disclosure, or arbitrary code execution. NVIDIA's...

CVE-2023-25505

NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause a buffer overflow, which may lead to denial of service, information disclosure, or arbitrary code execution...

CVE-2023-25505

NVIDIA DGX-1 BMC contains a vulnerability in the IPMI handler of the AMI MegaRAC BMC , where an attacker with the appropriate level of authorization can cause a buffer overflow, which may lead to denial of service, information disclosure, or arbitrary code execution...

CVE-2023-0209

NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware...

CVE-2023-0209

The CVE-2023-0209 issue affects NVIDIA DGX-1 SBIOS Uncore PEI: missing authentication of the SSA-executed code allows files/firmware to potentially execute arbitrary code, cause DoS, privilege escalation via firmware implants, information disclosure, data tampering, and SecureBoot bypass. Red Hat...

CVE-2023-0209

NVIDIA DGX-1 SBIOS contains a vulnerability in the Uncore PEI module, where authentication of the code executed by SSA is missing, which may lead to arbitrary code execution, denial of service, escalation of privileges assisted by a firmware implant, information disclosure assisted by a firmware...

CVE-2023-0207

NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful exploit of this vulnerability may lead to denial of service...

CVE-2023-0207

CVE-2023-0207 concerns the NVIDIA DGX-2 SBIOS vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code, potentially causing a denial of service. The connected NVIDIA bulletin lists remediation: DGX-2 SBIOS versions prior to 0.33 are address...

CVE-2023-0207

NVIDIA DGX-2 SBIOS contains a vulnerability where an attacker may modify the ServerSetup NVRAM variable at runtime by executing privileged code. A successful exploit of this vulnerability may lead to denial of service...

CVE-2023-0206

NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure...

CVE-2023-0206

NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the NVME SMM API. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure...

CVE-2023-0206

The CVE-2023-0206 entry affects NVIDIA DGX A100 SBIOS and describes an attack surface where an attacker may modify arbitrary memory in SMRAM by exploiting the NVME SMM API, potentially leading to denial of service, privilege escalation, and information disclosure. The NVIDIA firmware security bul...

CVE-2023-0202

NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may modify arbitrary memory of SMRAM by exploiting the GenericSio and LegacySmmSredir SMM APIs. A successful exploit of this vulnerability may lead to denial of service, escalation of privileges, and information disclosure...