Local Code Execution and Privilege Escalation in NVIDIA DGX A100 SBIOS

CVE-2022-28200

Summary

The NVIDIA DGX A100 contains a significant vulnerability within its SBIOS, specifically in the BiosCfgTool. This flaw allows a local user with elevated privileges to manipulate memory access beyond intended constraints in the System Management RAM (SMRAM). This exploitation can facilitate unauthorized code execution, lead to privilege escalation, and result in denial of service as well as potential information disclosure. The ramifications of this vulnerability can affect not only the DGX A100 itself but also extend to other interconnected components.

References