CVE-2022-31603
Assigner: nvidia
Published: 2022-07-04T18:10:36
State: PUBLISHED
affected: product: NVIDIA DGX A100
vendor: NVIDIA
versions: status: affected
version: Versions prior to 22.5.5
descriptions: value: NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data can exploit improper validation of an array index to cause code execution, which may lead to denial of service, data integrity impact, and information disclosure.
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-129
description: CWE-129 Improper Validation of Array Index
type: CWE