Vulnerability · Published Jan 24, 2024 · Assigned by nvidia
CVE-2023-31037
High 7.2
In plain English
A high-severity code injection in Bluefield 2 DPU BMC, BlueField 3 DPU BMC from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.7%top 45.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NVIDIA | Bluefield 2 DPU BMC, BlueField 3 DPU BMC | LTS:2.8.2-46, 23.04, 23.07, 23.09 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H