CVE-2022-31600

CWE-190 — Integer Overflow3 documents3 sources
Severity
8.2HIGH
EPSS
0.1%
top 79.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nvidia DGX A100 FirmwareNvidia Nvidia DGX A100
Timeline
PublishedJul 4
Latest updateJul 5

Description

NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and information disclosure. The scope of impact can extend to other components.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 0.8 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5nvidia/nvidia_dgx_a100Versions prior to 22.5.5

🔴Vulnerability Details

2
GHSA
GHSA-vcfg-vcq2-8xc9: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerabil↗2022-07-05
▶
CVEList
CVE-2022-31600: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerabil↗2022-07-04
▶