CVE-2022-28200
Severity Score
8.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
NVIDIA DGX A100 contains a vulnerability in SBIOS in the BiosCfgTool, where a local user with elevated privileges can read and write beyond intended bounds in SMRAM, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
NVIDIA DGX A100 contiene una vulnerabilidad en SBIOS en la BiosCfgTool, donde un usuario local con altos privilegios puede leer y escribir más allá de los límites previstos en la SMRAM, lo que puede conllevar a una ejecución de código, una escalada de privilegios, la denegación de servicio y una divulgación de información. El alcance del impacto puede extenderse a otros componentes
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-03-30 CVE Reserved
- 2022-07-02 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-787: Out-of-bounds Write
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://nvidia.custhelp.com/app/answers/detail/a_id/5367 | 2022-07-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Nvidia Search vendor "Nvidia" | Dgx A100 Firmware Search vendor "Nvidia" for product "Dgx A100 Firmware" | < 22.5.5 Search vendor "Nvidia" for product "Dgx A100 Firmware" and version " < 22.5.5" | - |
Affected
| in | Nvidia Search vendor "Nvidia" | Dgx A100 Search vendor "Nvidia" for product "Dgx A100" | - | - |
Safe
|