CVE-2023-25519

NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error. A successful exploit of this vulnerability may lead to escalation of privileges.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://https://nvidia.custhelp.com/app/answers/detail/a_id/5479	Broken Link
https://nvidia.custhelp.com/app/answers/detail/a_id/5479	Vendor Advisory
https://https://nvidia.custhelp.com/app/answers/detail/a_id/5479	Broken Link

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:nvidia:bluefield_1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:bluefield_1:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:nvidia:bluefield_2_lts_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:bluefield_2_lts:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:nvidia:bluefield_2_ga_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:bluefield_2_ga:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:nvidia:bluefield_3_ga_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:nvidia:bluefield_3_ga:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:49

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-12 02:15

Updated : 2024-11-21 07:49

NVD link : CVE-2023-25519

Mitre link : CVE-2023-25519

CVE.ORG link : CVE-2023-25519

JSON object : View

Products Affected

nvidia

bluefield_2_ga_firmware
bluefield_3_ga_firmware
bluefield_1
bluefield_1_firmware
bluefield_3_ga
bluefield_2_ga
bluefield_2_lts
bluefield_2_lts_firmware

CWE

CWE-286

Incorrect User Management

NVD-CWE-Other

{"id": "CVE-2023-25519", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-09-12T02:15:10.173", "references": [{"url": "https://https://nvidia.custhelp.com/app/answers/detail/a_id/5479", "tags": ["Broken Link"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5479", "tags": ["Vendor Advisory"], "source": "nvd@nist.gov"}, {"url": "https://https://nvidia.custhelp.com/app/answers/detail/a_id/5479", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-286"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "\nNVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error. A successful exploit of this vulnerability may lead to escalation of privileges.\u00a0 \n\n"}, {"lang": "es", "value": "NVIDIA ConnectX Host Firmware para BlueField Data Processing Unit contiene una vulnerabilidad en la que un anfitri\u00f3n restringido puede provocar un error de administraci\u00f3n de usuarios incorrecto. Una explotaci\u00f3n exitosa de esta vulnerabilidad puede provocar una escalada de privilegios. "}], "lastModified": "2024-11-21T07:49:39.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:bluefield_1_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C650DAD0-9A63-45B7-BDEF-7CCB3B1256FF", "versionStartIncluding": "18.24.1000"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:bluefield_1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "485AAB91-2835-4ABF-BBA9-647F73111358"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:bluefield_2_lts_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E192997-A07E-4D32-A164-E82F6F3302DE", "versionEndExcluding": "24.35.3006"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:bluefield_2_lts:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F1A755B8-4FF4-4209-9E49-580159B9DFC7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:bluefield_2_ga_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53E136D7-66BB-49E1-A9E2-7E1B58A74ABA", "versionEndExcluding": "24.38.1002"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:bluefield_2_ga:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BC213CA8-C172-4AB5-B66B-A5C71F470F33"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:bluefield_3_ga_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82957F72-C974-4407-AC3F-10F6678AF0F2", "versionEndExcluding": "32.38.1002"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:bluefield_3_ga:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E1A941D7-49CE-49DA-A730-71C598D11EE9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@nvidia.com"}