CVE-2021-23217
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA write operation only within a specific time window timed to corrupt code execution, which may…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA write operation only within a specific time window timed to corrupt code execution, which may impact confidentiality, integrity, or availability. The scope impact may extend to other components.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.30% probability · 23th percentile
- CISA KEV
- Not listed
- Affected
- nvidia/geforce gt 605 · nvidia/geforce gt 610 · nvidia/geforce gt 620 · nvidia/geforce gt 625 · nvidia/geforce gt 630 · nvidia/geforce gt 635 · nvidia/geforce gt 640 · nvidia/geforce gt 705 · nvidia/geforce gt 710 · nvidia/geforce gt 720 · nvidia/geforce gt 730 · nvidia/geforce gt 740 · nvidia/geforce gtx 645 · nvidia/geforce gtx 650 · nvidia/geforce gtx 650 ti · nvidia/geforce gtx 650 ti boost · nvidia/geforce gtx 660 · nvidia/geforce gtx 660 ti · nvidia/geforce gtx 670 · nvidia/geforce gtx 680 · +40 more
- Source
- psirt@nvidia.com
References
- https://nvidia.custhelp.com/app/answers/detail/a_id/5263Vendor Advisory
- https://nvidia.custhelp.com/app/answers/detail/a_id/5263Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.