CVE-2023-25529

CWE-208CWE-2033 documents3 sources
Severity
8.1HIGH
EPSS
0.3%
top 46.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Nvidia DGX H100 FirmwareNvidia DGX A100 BMCNvidia DGX H100 BMC
Timeline
PublishedSep 20

Description

NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s session token by observing timing discrepancies between server responses. A successful exploit of this vulnerability may lead to information disclosure, escalation of privileges, and data tampering.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:NExploitability: 1.6 | Impact: 5.8

Affected Packages3 packages

▶NVDnvidia/dgx_h100_firmware< 23.08.18
▶CVEListV5nvidia/dgx_a100_bmcAll BMC versions prior to 00.22.05
▶CVEListV5nvidia/dgx_h100_bmcAll versions prior to 23.08.07

🔴Vulnerability Details

2
CVEList
CVE-2023-25529: NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another us↗2023-09-20
▶
GHSA
GHSA-v8jc-h92c-w33g: NVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s session toke↗2023-09-20
▶
CVE-2023-25529 (HIGH CVSS 8.1) | NVIDIA DGX H100 BMC and DGX A100 BM | cvebase.io