CVE-2022-42262

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5415	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:nvidia:virtual_gpu::::::::
	cpe:2.3:a:nvidia:virtual_gpu::::::::
	cpe:2.3:a:nvidia:virtual_gpu::::::::

OR	cpe:2.3:o:citrix:hypervisor:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux_kernel-based_virtual_machine:-:::::::*
	cpe:2.3:o:vmware:vsphere:-:::::::*

Configuration 2 (hide)

AND

cpe:2.3:a:nvidia:cloud_gaming:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:citrix:hypervisor:-:::::::*
	cpe:2.3:o:redhat:enterprise_linux_kernel-based_virtual_machine:-:::::::*

Configuration 3 (hide)

AND

OR	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*
	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*

OR	cpe:2.3:a:nvidia:geforce:-:::::::*
	cpe:2.3:a:nvidia:nvs:-:::::::*
	cpe:2.3:a:nvidia:quadro:-:::::::*
	cpe:2.3:a:nvidia:rtx:-:::::::*

Configuration 4 (hide)

AND

OR	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*
	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*
	cpe:2.3:a:nvidia:gpu_display_driver::::::linux::*

cpe:2.3:a:nvidia:tesla:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-12-30 23:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-42262

Mitre link : CVE-2022-42262

CVE.ORG link : CVE-2022-42262

JSON object : View

Products Affected

citrix

hypervisor

nvidia

virtual_gpu
geforce
tesla
cloud_gaming
rtx
nvs
quadro
gpu_display_driver

linux

linux_kernel

vmware

vsphere

redhat

enterprise_linux_kernel-based_virtual_machine

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-42262", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "published": "2022-12-30T23:15:11.263", "references": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5415", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-120"}]}, {"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service."}, {"lang": "es", "value": "El software NVIDIA vGPU contiene una vulnerabilidad en Virtual GPU Manager (complemento vGPU), donde un \u00edndice de entrada no se valida, lo que puede provocar una saturaci\u00f3n del b\u00fafer, lo que a su vez puede causar manipulaci\u00f3n de datos, divulgaci\u00f3n de informaci\u00f3n o Denegaci\u00f3n de Servicio (DoS)."}], "lastModified": "2023-01-11T20:22:25.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85A2D2C0-6EF1-442E-987A-006E2652D955", "versionEndExcluding": "11.11"}, {"criteria": "cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C9963BB-DC0D-4799-84C4-B3A36BCE125B", "versionEndExcluding": "13.6", "versionStartIncluding": "12.0"}, {"criteria": "cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "230B9F4E-DFDF-4492-BE31-E781D1D3A956", "versionEndExcluding": "14.4", "versionStartIncluding": "14.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:citrix:hypervisor:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F7AE5C32-E060-44BA-8C13-3D73204191EE"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_kernel-based_virtual_machine:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "06C8B1C5-6401-45F9-8D3E-47E32067F428"}, {"criteria": "cpe:2.3:o:vmware:vsphere:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8E4A22C5-B3E1-4106-997C-D1C845F2C1EE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:cloud_gaming:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B75400C8-5AFF-4ED9-AF91-024FE6D125E0", "versionEndExcluding": "525.60.12"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:citrix:hypervisor:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F7AE5C32-E060-44BA-8C13-3D73204191EE"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux_kernel-based_virtual_machine:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "06C8B1C5-6401-45F9-8D3E-47E32067F428"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "1ACD2E2B-EDDA-4D52-B7D2-3387A80359A5", "versionEndExcluding": "470.161.03", "versionStartIncluding": "470"}, {"criteria": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "1A381E4A-95A8-4002-9919-D8A23B41525A", "versionEndExcluding": "510.108.03", "versionStartIncluding": "510"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:geforce:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "24DE5CC2-3787-4605-8EFA-77590E36E960"}, {"criteria": "cpe:2.3:a:nvidia:nvs:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "333646B0-AAD5-4DD7-8940-6334D0A8E77C"}, {"criteria": "cpe:2.3:a:nvidia:quadro:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A1DB9FB5-E115-4E96-98F8-3FAFAC120E98"}, {"criteria": "cpe:2.3:a:nvidia:rtx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "08C63EA1-8719-4F5C-922A-C77ED4CEF7C7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "92F71F1A-E866-4C73-BA7E-CA72CDCCF295", "versionEndExcluding": "450.216.04", "versionStartIncluding": "450"}, {"criteria": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "1ACD2E2B-EDDA-4D52-B7D2-3387A80359A5", "versionEndExcluding": "470.161.03", "versionStartIncluding": "470"}, {"criteria": "cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "1A381E4A-95A8-4002-9919-D8A23B41525A", "versionEndExcluding": "510.108.03", "versionStartIncluding": "510"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:tesla:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D135086F-CA5E-4242-ACBA-C3AC82F4BE03"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@nvidia.com"}