CVE-2022-42276

HIGH

NVIDIA DGX A100 Firmware < 1.18 - Authenticated Arbitrary Flash Access via SmiFlash

Title source: llm
STIX 2.1

Description

NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0005
EPSS Percentile 14.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-306 CWE-288
Status published
Products (1)
nvidia/dgx_a100_firmware < 1.18
Published Jan 13, 2023
Tracked Since Feb 18, 2026