Command Interface Write Out of Bounds in NVIDIA ConnectX and BlueField

Executive Summary

This vulnerability exists in NVIDIA ConnectX and BlueField products within their command interface. A local user who has virtual function (VF) access can provide specially crafted input that causes a write operation outside the intended memory boundaries (out-of-bounds write).

If successfully exploited, this flaw can allow the attacker to execute arbitrary code on the affected device, potentially taking control of it.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is severe because it allows a local user with VF access to execute arbitrary code on the device. This can lead to unauthorized control over the device, potentially compromising its integrity, confidentiality, and availability.

Such control could be used to disrupt device operations, steal sensitive information, or use the device as a foothold for further attacks within a network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update your NVIDIA ConnectX and BlueField products to the patched versions. Specifically, upgrade to versions 46.3008 or later for ConnectX GA and BlueField GA, and 35.8002 or later for ConnectX LTS22 and BlueField LTS22.

Limiting local user access to virtual functions (VF) on affected devices can also reduce the risk of exploitation.

Useful 0 Not Useful 0