CVE-2022-42261

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.

CVSS v3.0 7.8 HIGH

7.8^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5415	Vendor Advisory
https://security.gentoo.org/glsa/202310-02	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:nvidia:virtual_gpu::::::::
	cpe:2.3:a:nvidia:virtual_gpu::::::::
	cpe:2.3:a:nvidia:virtual_gpu::::::::

OR	cpe:2.3:o:citrix:hypervisor:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux_kernel-based_virtual_machine:-:::::::*
	cpe:2.3:o:vmware:vsphere:-:::::::*

Configuration 2 (hide)

AND

cpe:2.3:a:nvidia:cloud_gaming:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:citrix:hypervisor:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux_kernel-based_virtual_machine:-:::::::*

Configuration 3 (hide)

AND

OR	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*
	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*

OR	cpe:2.3:a:nvidia:geforce:-:::::::*
	cpe:2.3:a:nvidia:nvs:-:::::::*
	cpe:2.3:a:nvidia:quadro:-:::::::*
	cpe:2.3:a:nvidia:rtx:-:::::::*

Configuration 4 (hide)

AND

OR	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*
	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*
	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*

cpe:2.3:a:nvidia:tesla:-:*:*:*:*:*:*:*

History

19 Oct 2023, 01:33

Type	Values Removed	Values Added
References		(GENTOO) https://security.gentoo.org/glsa/202310-02 - Third Party Advisory

Information

Published : 2022-12-30 23:15

Updated : 2023-10-19 01:33

NVD link : CVE-2022-42261

Mitre link : CVE-2022-42261

JSON object : View

Products Affected

citrix

hypervisor

nvidia

geforce
nvs
virtual_gpu
quadro
cloud_gaming
gpu_display_driver
rtx
tesla

redhat

enterprise_linux_kernel-based_virtual_machine

vmware

vsphere

linux

linux_kernel

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5415", "name": "https://nvidia.custhelp.com/app/answers/detail/a_id/5415", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://security.gentoo.org/glsa/202310-02", "name": "GLSA-202310-02", "tags": ["Third Party Advisory"], "refsource": "GENTOO"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-120"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-42261", "ASSIGNER": "psirt@nvidia.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}}, "publishedDate": "2022-12-30T23:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "11.11"}, {"cpe23Uri": "cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "13.6", "versionStartIncluding": "12.0"}, {"cpe23Uri": "cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "14.4", "versionStartIncluding": "14.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:citrix:hypervisor:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_kernel-based_virtual_machine:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:vmware:vsphere:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nvidia:cloud_gaming:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "525.60.12"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:citrix:hypervisor:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_kernel-based_virtual_machine:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "470.161.03", "versionStartIncluding": "470"}, {"cpe23Uri": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "510.108.03", "versionStartIncluding": "510"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nvidia:geforce:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:a:nvidia:nvs:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:a:nvidia:quadro:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:a:nvidia:rtx:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "450.216.04", "versionStartIncluding": "450"}, {"cpe23Uri": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "470.161.03", "versionStartIncluding": "470"}, {"cpe23Uri": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "510.108.03", "versionStartIncluding": "510"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nvidia:tesla:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-10-19T01:33Z"}