NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
BlueField GA
Vendor
NVIDIA
Product
BlueField GA
Platforms
BlueField-2(46)
BlueField-3(46)
Default status
unaffected
BlueField GA · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions prior to 46.3008
affected
Unavailable
Unavailable
Unavailable
None listed
BlueField LTS22
Vendor
NVIDIA
Product
BlueField LTS22
Platforms
BlueField-2(35)
Default status
unaffected
BlueField LTS22 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions prior to 35.8002
affected
Unavailable
Unavailable
Unavailable
None listed
BlueField LTS23
Vendor
NVIDIA
Product
BlueField LTS23
Platforms
BlueField-2(39)
BlueField-3(39)
Default status
unaffected
BlueField LTS23 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All versions prior to 39.8002
affected
Unavailable
Unavailable
Unavailable
None listed
BlueField LTS24
Vendor
NVIDIA
Product
BlueField LTS24
Platforms
BlueField-2(43)
BlueField-3(43)
Default status
unaffected
BlueField LTS24 · Scoped product and version facts