Local User Privilege Escalation Vulnerability in NVIDIA DGX Station SBIOS
CVE-2022-42277

7.5HIGH

Key Information:

Vendor

Nvidia
Status
Nvidia Dgx Servers
Vendor
CVE Published:
13 January 2023

What is CVE-2022-42277?

NVIDIA DGX Station contains a vulnerability in its SBIOS related to SmiFlash, where a local user with elevated privileges can manipulate system flash memory. This manipulation can result in unauthorized code execution, escalation of privileges, denial of service, and potential information disclosure. The impact of this vulnerability may extend beyond the immediate component, affecting other connected systems and applications.

Affected Version(s)

NVIDIA DGX servers All SBIOS firmware versions prior to 10.16

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5435

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.