Memory Modification Vulnerability in NVIDIA DGX A100 SBIOS
CVE-2023-0202

7.5HIGH

Key Information:

Vendor
Nvidia
Status
Nvidia Dgx Servers
Vendor
CVE Published:
22 April 2023

Summary

NVIDIA DGX A100 SBIOS is susceptible to a security flaw that allows attackers to modify arbitrary memory in SMRAM via the exploitation of the GenericSio and LegacySmmSredir SMM APIs. This vulnerability could result in various impacts, including denial of service, unwanted privilege escalation, and potential disclosure of sensitive information, making it a significant concern for system integrity.

Affected Version(s)

NVIDIA DGX servers All SBIOS versions prior to 1.18

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5449

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.