CVE-2022-42272 — Classic Buffer Overflow in Nvidia DGX A100 Firmware

CWE-120 — Classic Buffer Overflow3 documents3 sources
Severity
8.8HIGHNVD
CNA8.1
EPSS
0.8%
top 26.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nvidia DGX A100 FirmwareNvidia DGX Servers
Timeline
PublishedJan 12
Latest updateJan 13

Description

NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denial of service or escalation of privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDnvidia/dgx_a100_firmware< 00.19.07
▶CVEListV5nvidia/nvidia_dgx_serversAll BMC firmware versions prior to 00.19.07

🔴Vulnerability Details

2
GHSA
GHSA-q9hw-5mq9-f9jp: NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denia↗2023-01-13
▶
CVEList
CVE-2022-42272: NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denia↗2023-01-12
▶
CVE-2022-42272 — Classic Buffer Overflow in Nvidia | cvebase