CVE-2022-42276

CWE-288CWE-306 — Missing Authentication3 documents3 sources
Severity
8.2HIGH
EPSS
0.0%
top 85.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nvidia DGX A100 FirmwareNvidia Nvidia DGX Servers
Timeline
PublishedJan 13

Description

NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 0.8 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5nvidia/nvidia_dgx_serversAll SBIOS firmware versions prior to 1.18

🔴Vulnerability Details

2
GHSA
GHSA-r3r2-xcc8-f7fp: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which↗2023-01-13
▶
CVEList
CVE-2022-42276: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which↗2023-01-13
▶
CVE-2022-42276 (HIGH CVSS 8.2) | NVIDIA DGX A100 contains a vulnerab | cvebase.io