CVE-2024-0105 - Vulnerability Details - OpenCVE

NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00051.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://nvidia.custhelp.com/app/answers/detail/a_id/5562

History

Fri, 01 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 01 Nov 2024 05:45:00 +0000

Type	Values Removed	Values Added
Description		NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.
Weaknesses		CWE-274
References		https://nvidia.custhelp.com/app/answers/detail/a_id/5562
Metrics		cvssV3_1 `{'score': 8.9, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: nvidia

Published: 2024-11-01T05:36:06.601Z

Updated: 2024-11-01T14:17:06.384Z

Reserved: 2023-12-02T00:42:15.099Z

Link: CVE-2024-0105

Vulnrichment

Updated: 2024-11-01T14:17:01.854Z

NVD

Status : Awaiting Analysis

Published: 2024-11-01T06:15:12.397

Modified: 2024-11-01T12:57:03.417

Link: CVE-2024-0105

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0105", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2023-12-02T00:42:15.099Z", "datePublished": "2024-11-01T05:36:06.601Z", "dateUpdated": "2024-11-01T14:17:06.384Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ConnectX4", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 12.28.2302"}]}, {"defaultStatus": "unaffected", "product": "ConnectX4 LX", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to xx.32.1900"}]}, {"defaultStatus": "unaffected", "platforms": ["ConnectX 6", "ConnectX 6 DX", "ConnectX 6 LX", "ConnectX 7"], "product": "ConnectX GA", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to xx.41.1000"}]}, {"defaultStatus": "unaffected", "platforms": ["ConnectX 5", "ConnectX 6", "ConnectX 6 DX", "ConnectX 6 LX", "ConnectX 7"], "product": "ConnectX LTS22", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to xx.35.4030"}]}, {"defaultStatus": "unaffected", "platforms": ["ConnectX 6", "ConnectX 6 DX", "ConnectX 6 LX", "ConnectX 7"], "product": "ConnectX LTS23", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to xx.39.3560"}]}, {"defaultStatus": "unaffected", "product": "BlueField 1", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to 18.31.1014"}]}, {"defaultStatus": "unaffected", "platforms": ["BlueField 2", "BlueField 3"], "product": "BlueField GA", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to xx.41.1000"}]}, {"defaultStatus": "unaffected", "platforms": ["BlueField 2"], "product": "BlueField LTS22", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to xx.35.4030"}]}, {"defaultStatus": "unaffected", "platforms": ["BlueField 2", "BlueField 3"], "product": "BlueField LTS23", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "All versions prior to xx.39.3560"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.</span>"}], "value": "NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of service, data tampering, and limited information disclosure"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.9, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-274", "description": "CWE-274", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2024-11-01T05:36:06.601Z"}, "references": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5562"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-01T14:16:56.978053Z", "id": "CVE-2024-0105", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T14:17:06.384Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0105", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-01T14:16:56.978053Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T14:17:01.854Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of service, data tampering, and limited information disclosure"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.9, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NVIDIA", "product": "ConnectX4", "versions": [{"status": "affected", "version": "All versions prior to 12.28.2302"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX4 LX", "versions": [{"status": "affected", "version": "All versions prior to xx.32.1900"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX GA", "versions": [{"status": "affected", "version": "All versions prior to xx.41.1000"}], "platforms": ["ConnectX 6", "ConnectX 6 DX", "ConnectX 6 LX", "ConnectX 7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS22", "versions": [{"status": "affected", "version": "All versions prior to xx.35.4030"}], "platforms": ["ConnectX 5", "ConnectX 6", "ConnectX 6 DX", "ConnectX 6 LX", "ConnectX 7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "ConnectX LTS23", "versions": [{"status": "affected", "version": "All versions prior to xx.39.3560"}], "platforms": ["ConnectX 6", "ConnectX 6 DX", "ConnectX 6 LX", "ConnectX 7"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField 1", "versions": [{"status": "affected", "version": "All versions prior to 18.31.1014"}], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField GA", "versions": [{"status": "affected", "version": "All versions prior to xx.41.1000"}], "platforms": ["BlueField 2", "BlueField 3"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS22", "versions": [{"status": "affected", "version": "All versions prior to xx.35.4030"}], "platforms": ["BlueField 2"], "defaultStatus": "unaffected"}, {"vendor": "NVIDIA", "product": "BlueField LTS23", "versions": [{"status": "affected", "version": "All versions prior to xx.39.3560"}], "platforms": ["BlueField 2", "BlueField 3"], "defaultStatus": "unaffected"}], "references": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5562"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-274", "description": "CWE-274"}]}], "providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2024-11-01T05:36:06.601Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0105", "state": "PUBLISHED", "dateUpdated": "2024-11-01T14:17:06.384Z", "dateReserved": "2023-12-02T00:42:15.099Z", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "datePublished": "2024-11-01T05:36:06.601Z", "assignerShortName": "nvidia"}, "dataVersion": "5.1"}