CVE-2023-0203 - OpenCVE

NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Nvidia	Connectx-5 Connectx-6-dx Connectx-6 Connectx Firmware

Configuration 1 [-]

AND

cpe:2.3:o:nvidia:connectx_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:nvidia:connectx-5:-:::::::*
	cpe:2.3:h:nvidia:connectx-6:-:::::::*
	cpe:2.3:h:nvidia:connectx-6-dx:-:::::::*

References

Link	Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5459	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: nvidia

Published: 2023-04-22T02:24:15.822Z

Updated: 2023-04-22T02:24:15.822Z

Reserved: 2023-01-11T05:48:53.613Z

Link: CVE-2023-0203

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-04-22T03:15:09.270

Modified: 2023-05-02T13:53:49.337

Link: CVE-2023-0203

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:nvidia:connectx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "22D68BAB-D2DD-4997-9881-15F3243A9D7B", "versionEndExcluding": "35.1012", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:nvidia:connectx-5:-:*:*:*:*:*:*:*", "matchCriteriaId": "85FBF3A9-B6C3-4705-A2E1-2503E7A6725D", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:connectx-6:-:*:*:*:*:*:*:*", "matchCriteriaId": "8421C891-26D3-4845-A20A-80E4769D4E25", "vulnerable": false}, {"criteria": "cpe:2.3:h:nvidia:connectx-6-dx:-:*:*:*:*:*:*:*", "matchCriteriaId": "6BAADC39-548E-44E4-AD25-74A7CEBCC2EB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "NVIDIA ConnectX-5, ConnectX-6, and ConnectX6-DX contain a vulnerability in the NIC firmware, where an unprivileged user can exploit insufficient granularity of access control, which may lead to denial of service."}], "id": "CVE-2023-0203", "lastModified": "2023-05-02T13:53:49.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "psirt@nvidia.com", "type": "Secondary"}]}, "published": "2023-04-22T03:15:09.270", "references": [{"source": "psirt@nvidia.com", "tags": ["Vendor Advisory"], "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5459"}], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-1220"}], "source": "psirt@nvidia.com", "type": "Secondary"}]}