VULNERABILITY INTELLIGENCE

CVE-2022-42276

CVSS score7.5 HIGH
EPSS probability0.19%
CISA KEVNot currently listed
Published2023-01-13
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Description

NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.

Weakness classification

  • psirt@nvidia.com: CWE-288
  • nvd@nist.gov: CWE-306

Primary references