{"schemaVersion":3,"id":"CVE-2022-21821","aliases":["UBUNTU-CVE-2022-21821","DEBIAN-CVE-2022-21821"],"status":"published","duplicateOf":null,"title":null,"description":"NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.","dates":{"published":"2022-03-29T20:05:11.000Z","modified":"2024-08-03T02:53:36.263Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02089,"percentile":0.81318,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.02089},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02089,"percentile":0.81318}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02089,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02089,"percentile":0.81318}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1285","name":"Improper Validation of Specified Index, Position, or Offset in Input","description":"The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1285.html"},{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"debian","product":"nvidia-cuda-toolkit","name":"nvidia-cuda-toolkit","label":"nvidia-cuda-toolkit","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/nvidia-cuda-toolkit","purlType":"deb","versions":[{"text":"< 11.6.2-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.6.2-2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"nvidia-cuda-toolkit","name":"nvidia-cuda-toolkit","label":"nvidia-cuda-toolkit","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/nvidia-cuda-toolkit","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"nvidia","product":"cuda_toolkit","name":"cuda toolkit","label":"cuda_toolkit","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 11.6.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.6.2","eol":null,"hubHref":"/vendor/nvidia/cuda_toolkit"},{"vendor":"nvidia","product":"nvidia cuda toolkit","name":"NVIDIA CUDA Toolkit","label":"nvidia cuda toolkit","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions prior to 11.6 Update 2","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions prior to 11.6 Update 2","eol":null,"hubHref":"/vendor/nvidia/nvidia_cuda_toolkit"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://nvidia.custhelp.com/app/answers/detail/a_id/5334","label":"nvidia.custhelp.com/app/answers/detail/a_id/5334","hostname":"nvidia.custhelp.com","tags":["X Refsource MISC","REPORT","Mitigation","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21821","label":"ubuntu.com/security/CVE-2022-21821","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21821","label":"www.cve.org/CVERecord?id=CVE-2022-21821","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21821","label":"security-tracker.debian.org/tracker/CVE-2022-21821","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-03-29T20:05:11.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T02:53:36.263Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T00:39:38.498Z","stale":false,"partial":false}}