USN-6608-2: Linux kernel (NVIDIA) vulnerabilities

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate the server frame size in certain situation, leading to an out-of-bounds read vulnerability. An attacker could use this to construct a malicious CIFS image that, when operated on, could...

Ubuntu 22.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-6608-2)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6608-2 advisory. It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate the server frame size in certain...

Security Bulletin: NVIDIA DGX Station A100 and DGX Station A800 - February 2024

NVIDIA has released a firmware security update for the NVIDIA DGX™ Station A100 and DGX™ Station A800 systems. To protect your system, download and install this firmware update through the NVIDIA Enterprise Support Portal. Go to NVIDIA Product Security. Details This section provides a summary of...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-049)

The version of kernel installed on the remote host is prior to 5.10.82-83.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-049 advisory. A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose handler could...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: syft, kaniko, grype, k9s, kubescape, nerdctl, skopeo, docker, cadvisor, k3d, k3s, skaffold, runc, zot, podman, trivy, wolfictl, kots, newrelic-infrastructure-agent, kubernetes, buildkitd, ctop, zarf...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: syft, skopeo, kubernetes, skaffold, kubescape, kots, k9s, ctop, k3s, docker, podman, zarf, wolfictl, runc, zot, trivy, k3d, buildkitd, kaniko, cadvisor, newrelic-infrastructure-agent, nerdctl, grype...

Ubuntu: Security Advisory (USN-6609-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6609-2: Linux kernel (NVIDIA) vulnerabilities

Lin Ma discovered that the netfilter subsystem in the Linux kernel did not properly validate network family support while creating a new netfilter table. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2023-6040 It was discovered that the CIFS...

CVE-2023-31037

NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS...

CVE-2023-31037

NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS...

Code injection

NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS...

CVE-2023-31037

The CVE-2023-31037 issue affects NVIDIA BlueField 2 and BlueField 3 DPU BMC with a vulnerability in ipmitool that allows a root user to trigger code injection via a network call, potentially leading to OS code execution. Public details confirm the affected products are BlueField DPU BMCs and iden...

CVE-2023-31037

NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS...

CVE-2023-31037

NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS...

NVIDIA BMC Operating System Command Injection Vulnerability

NVIDIA BMC is an OpenBMC open software framework from NVIDIA. A security vulnerability exists in NVIDIA BMC, which originates from a root user that could lead to code injection via a network call, which could be exploited by an attacker to cause code execution on the operating system...

CVE-2023-31037: Improper Control of Generation of Code

NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS...

PT-2024-21509

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.19 and 6.7.7 Description The issue concerns a null pointer dereference in the 'nvidia-shield' component of the Linux kernel. This occurs because the devm kasprintf function returns a pointer to dynamically...

Security Bulletin: NVIDIA BlueField 2 and 3 BMC - January 2024

NVIDIA has released a firmware update for NVIDIA BlueField DPU Baseboard Management Controller BMC. To protect your system, download and install this firmware update from the NVIDIA DOCA Software Framework page. Go to NVIDIA Product Security. Details This section provides a summary of potential...

The vulnerability of NVIDIA’s SBIOS system, specifically the DGX A100 server, allows a hacker to gain access to read, modify, or delete data, execute arbitrary code, or trigger a service failure.

The vulnerability of the SBIOS system’s NVIDIA DGX A100 server lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain access to read, modify, or delete data, execute arbitrary code, or cause a service failure...

The vulnerability of NVIDIA’s SBIOS system, specifically the DGX A100 server, allows a hacker to trigger a service failure.

The vulnerability of NVIDIA’s SBIOS system, specifically the DGX A100 server, is related to incorrect dynamic analysis of variables. Exploiting this vulnerability can allow attackers to cause service failures...