CVE-2022-42288 — Observable Timing Discrepancy in Nvidia DGX A100 Firmware

CWE-208 — Observable Timing DiscrepancyCWE-203 — Observable Discrepancy3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.4%
top 41.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nvidia DGX A100 FirmwareNvidia DGX Servers
Timeline
PublishedJan 13

Description

NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an information disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDnvidia/dgx_a100_firmware< 00.19.07
▶CVEListV5nvidia/nvidia_dgx_serversAll BMC firmware versions prior to 00.19.07

🔴Vulnerability Details

2
CVEList
CVE-2022-42288: NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may l↗2023-01-13
▶
GHSA
GHSA-326f-jv9v-g2jj: NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may l↗2023-01-13
▶
CVE-2022-42288 — Observable Timing Discrepancy | cvebase