Arbitrary Code Execution in NVIDIA DGX-1 SBIOS Uncore PEI Module
CVE-2023-0209

8.2HIGH

Key Information:

Vendor
Nvidia
Status
Nvidia Dgx Servers
Vendor
CVE Published:
22 April 2023

Summary

The NVIDIA DGX-1 SBIOS features a vulnerability within the Uncore PEI module that lacks appropriate authentication for code executed by SSA. This oversight opens the door to various threats, including arbitrary code execution, denial of service, and escalation of privileges via firmware implants. Additionally, sensitive information could be disclosed, data could be manipulated, and SecureBoot protections could be circumvented, posing significant risks to system integrity and security.

Affected Version(s)

NVIDIA DGX servers All SBIOS prior to S2W_3A13

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5458

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.