CVE-2023-25519
High
Description
NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error. A successful exploit of this vulnerability may lead to escalation of privileges.
SeverityHigh
CVSS7.8
Exploit probability—
ProductNvidia Bluefield 1 Firmware
PublishedSep 12, 2023
First seenSep 12, 2023
Weakness typeCWE-286CWE-286
How to fix
Update
- nvidia bluefield_2_lts_firmware24.35.3006 or later
- nvidia bluefield_2_ga_firmware24.38.1002 or later
- nvidia bluefield_3_ga_firmware32.38.1002 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nvidia bluefield_1_firmware | 18.24.1000 ≤ v | — |
| nvidia bluefield_2_lts_firmware | v < 24.35.3006 | 24.35.3006 |
| nvidia bluefield_2_ga_firmware | v < 24.38.1002 | 24.38.1002 |
| nvidia bluefield_3_ga_firmware | v < 32.38.1002 | 32.38.1002 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.