CVE
CVE-2023-31035

7.5HIGH

Key Information:

Vendor

Nvidia
Status
Dgx A100
Vendor
CVE Published:
12 January 2024

What is CVE-2023-31035?

The SBIOS within the NVIDIA DGX A100 has a vulnerability that could allow attackers to exploit an SMI callout, leading to potential arbitrary code execution at the System Management Mode (SMM) level. This vulnerability poses risks that can lead to not only unauthorized code execution but also denial of service, privilege escalation, and risk of sensitive information exposure. Organizations utilizing the DGX A100 should be aware of this security issue and take necessary precautions to mitigate any potential risks.

Affected Version(s)

DGX A100 All SBOIS versions prior to 1.25

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5510

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.