CVE-2023-0200: nvidia bmc

Vulnerability summary

CVE-2023-0200 is a high (CVSS 7.5) vulnerability in nvidia bmc. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6% of scored vulnerabilities.

Timeline

1. 22-04-2023
   PublishedVulnerability first disclosed.
2. 04-02-2025
   Last modifiedVulnerability information updated.

Description

NVIDIA DGX-2 contains a vulnerability in OFBD where a user with high privileges and a pre-conditioned heap can cause an access beyond a buffers end, which may lead to code execution, escalation of privileges, denial of service, and information disclosure.

• CWE-788Access of Memory Location After End of BufferThe product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.