Vulnerability · Published Sep 20, 2023 · Assigned by nvidia
CVE-2023-25529
High 8.0
In plain English
A high-severity security flaw in DGX A100 BMC from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.6%top 49.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s session token by observing timing discrepancies between server responses. A successful exploit of this vulnerability may lead to information disclosure, escalation of privileges, and data tampering.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NVIDIA | DGX H100 BMC | All versions prior to 23.08.07 |
| NVIDIA | DGX A100 BMC | All BMC versions prior to 00.22.05 |
Weakness: CWE-208 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N