Log in Start free

Vulnerability · Published Mar 29, 2022 · Assigned by nvidia

CVE-2022-21821

High 7.8

In plain English

A high-severity security flaw in NVIDIA CUDA Toolkit from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)2.1%top 18.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nvidia-cuda-toolkit11.6.2-2DEBIAN-CVE-2022-21821
Debian:13nvidia-cuda-toolkit11.6.2-2DEBIAN-CVE-2022-21821
Ubuntu:22.04:LTSnvidia-cuda-toolkitno fix listedUBUNTU-CVE-2022-21821
Ubuntu:24.04:LTSnvidia-cuda-toolkitno fix listedUBUNTU-CVE-2022-21821
Ubuntu:25.10nvidia-cuda-toolkitno fix listedUBUNTU-CVE-2022-21821
Ubuntu:26.04:LTSnvidia-cuda-toolkitno fix listedUBUNTU-CVE-2022-21821
Ubuntu:26.10nvidia-cuda-toolkitno fix listedUBUNTU-CVE-2022-21821

Affected products (as reported)

VendorProductVersions
NVIDIA NVIDIA CUDA Toolkit All versions prior to 11.6 Update 2

Weakness: CWE-1285 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References