CVE-2022-31609

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest is not authorized. This vulnerability may lead to loss of data integrity and confidentiality, denial of service, or information disclosure.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5383	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nvidia:virtual_gpu::::::::
	cpe:2.3:a:nvidia:virtual_gpu::::::::
	cpe:2.3:a:nvidia:virtual_gpu:14.0:::::::*
	cpe:2.3:a:nvidia:virtual_gpu:14.1:::::::*

History

No history.

Information

Published : 2022-08-05 21:15

Updated : 2023-07-24 13:07

NVD link : CVE-2022-31609

Mitre link : CVE-2022-31609

CVE.ORG link : CVE-2022-31609

JSON object : View

Products Affected

nvidia

virtual_gpu

CWE

NVD-CWE-Other CWE-285

Improper Authorization

{"id": "CVE-2022-31609", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-08-05T21:15:08.813", "references": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest is not authorized. This vulnerability may lead to loss of data integrity and confidentiality, denial of service, or information disclosure."}, {"lang": "es", "value": "El software NVIDIA vGPU contiene una vulnerabilidad en el Virtual GPU Manager (vGPU plugin), donde permite que la VM invitada asigne recursos para los que el invitado no est\u00e1 autorizado. Esta vulnerabilidad puede conllevar a una p\u00e9rdida de integridad y confidencialidad de los datos, una denegaci\u00f3n de servicio o una divulgaci\u00f3n de informaci\u00f3n"}], "lastModified": "2023-07-24T13:07:41.953", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45F338C5-245D-4D10-9B48-B56B7094F167", "versionEndExcluding": "11.8", "versionStartIncluding": "11.0"}, {"criteria": "cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98C8F13F-2F8F-4BAE-B971-582084B93D58", "versionEndExcluding": "13.3", "versionStartIncluding": "13.0"}, {"criteria": "cpe:2.3:a:nvidia:virtual_gpu:14.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CB2F728-3BFD-418D-AC29-A4165D1E7CA6"}, {"criteria": "cpe:2.3:a:nvidia:virtual_gpu:14.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3C0C0B2-C4DC-4DB8-BD80-D6082FD1248B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}