CVE-2023-25506: nvidia nvidia dgx servers

Vulnerability summary

CVE-2023-25506 is a high (CVSS 8.2) vulnerability in nvidia nvidia dgx servers. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.5% of scored vulnerabilities.

Timeline

1. 22-04-2023
   PublishedVulnerability first disclosed.
2. 04-02-2025
   Last modifiedVulnerability information updated.

Description

NVIDIA DGX-1 contains a vulnerability in Ofbd in AMI SBIOS, where a preconditioned heap can allow a user with elevated privileges to cause an access beyond the end of a buffer, which may lead to code execution, escalation of privileges, denial of service and information disclosure. The scope of the impact of this vulnerability can extend to other components.

• CWE-788Access of Memory Location After End of BufferThe product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.