CVE-2022-21821

NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.

CVSS v3 7.8 HIGH
CVSS v2.0 6.8 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5334	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:nvidia:cuda_toolkit:*:*:*:*:*:*:*:*

OR	cpe:2.3:a:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

08 Apr 2022, 14:31

Type	Values Removed	Values Added
CWE		CWE-190
CPE		cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:linux:linux_kernel:-:::::::* cpe:2.3:a:nvidia:cuda_toolkit::::::::
First Time		Linux linux Kernel Microsoft windows Microsoft Linux Nvidia Nvidia cuda Toolkit
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : 6.8 v3 : 7.8
References	~~(CONFIRM) https://nvidia.custhelp.com/app/answers/detail/a_id/5334 -~~	(CONFIRM) https://nvidia.custhelp.com/app/answers/detail/a_id/5334 - Mitigation, Vendor Advisory

29 Mar 2022, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-03-29 20:15

Updated : 2023-12-10 14:22

NVD link : CVE-2022-21821

Mitre link : CVE-2022-21821

CVE.ORG link : CVE-2022-21821

JSON object : View

Products Affected

microsoft

windows

nvidia

cuda_toolkit

linux

linux_kernel

CWE

CWE-190

Integer Overflow or Wraparound

CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input

{"id": "CVE-2022-21821", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-03-29T20:15:07.783", "references": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5334", "tags": ["Mitigation", "Vendor Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}, {"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-1285"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity."}, {"lang": "es", "value": "NVIDIA CUDA Toolkit SDK contiene una vulnerabilidad de desbordamiento de enteros en cuobjdump.Para explotar esta vulnerabilidad, un atacante remoto requerir\u00eda que un usuario local descargara un archivo especialmente dise\u00f1ado y corrupto y ejecutara localmente cuobjdump contra el archivo. Este ataque puede conllevar a una ejecuci\u00f3n de c\u00f3digo remota que cause una denegaci\u00f3n de servicio completa y un impacto en la confidencialidad e integridad de los datos"}], "lastModified": "2022-04-08T14:31:45.347", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:cuda_toolkit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D761DE23-B60F-4322-A954-0E3F1C5F7A79", "versionEndExcluding": "11.6.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8BA79AC0-A0CC-4EE6-AEF5-9B8C8EA2C9F1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@nvidia.com"}