8.7

CVE-2024-0106

NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit (DPU) contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorNVIDIA
≫
Product BlueField 1
Default Statusunaffected
Version All versions prior to 18.31.1014
Status affected
VendorNVIDIA
≫
Product BlueField GA
Default Statusunaffected
Version All versions prior to xx.41.1000
Status affected
VendorNVIDIA
≫
Product BlueField LTS22
Default Statusunaffected
Version All versions prior to xx.35.4030
Status affected
VendorNVIDIA
≫
Product BlueField LTS23
Default Statusunaffected
Version All versions prior to xx.39.3560
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.068
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
psirt@nvidia.com 8.7 2 6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CWE-274 Improper Handling of Insufficient Privileges

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.