CVE-2022-42286 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Nvidia Sbios

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer3 documents3 sources

Severity

7.8HIGHNVD

CNA6.0

EPSS

0.1%

top 83.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Nvidia Sbios Nvidia DGX Servers

Timeline

PublishedJan 13

Description

DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDnvidia/sbios< 1.18

▶CVEListV5nvidia/nvidia_dgx_serversAll SBIOS firmware versions prior to 1.18

🔴Vulnerability Details

GHSA

GHSA-35c2-3wwv-hfxv: DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges↗2023-01-13

▶

CVEList

CVE-2022-42286: DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges↗2023-01-13

▶