CVE-2022-28200 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Nvidia DGX A100 Firmware

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-787 — Out-of-bounds Write3 documents3 sources
Severity
8.2HIGHNVD
EPSS
0.1%
top 81.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nvidia DGX A100 FirmwareNvidia DGX A100
Timeline
PublishedJul 2
Latest updateJul 3

Description

NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended bounds in SMRAM, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 1.5 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5nvidia/nvidia_dgx_a100Versions prior to 22.5.5

🔴Vulnerability Details

2
GHSA
GHSA-mqfm-vc95-gg95: NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended b↗2022-07-03
▶
CVEList
CVE-2022-28200: NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended b↗2022-07-02
▶
CVE-2022-28200 — Nvidia DGX A100 Firmware vulnerability | cvebase