ConnectX / BlueField firmware: Improper certificate validation

CVSS 8.9CVE-2024-0105NVIDIA / GPU stackcurated

Impact

Improper certificate validation -> malicious firmware/image accepted

Who can reach it

Network-adjacent attacker in the firmware update path

What to do

Flash NIC/DPU firmware; verify update chain; node reboot with tenant eviction

References

https://nvd.nist.gov/vuln/detail/CVE-2024-0105 https://github.com/NVIDIA/product-security/tree/main/2024/5562

Related entries

NVIDIA UNIX (Linux/FreeBSD/Solaris) GPU driver before 295.40 - /dev/nvidia* device node: The GPU-side twin ofCVE-2012-0946 · NVIDIA UNIX (Linux/FreeBSD/Solaris) GPU driver before 295.40 - /dev/nvidia* device nodeHigh
NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Any local account on a Windows GPU host can call the driver's escapeCVE-2018-6247 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Out-of-bounds kernel read/write from an unprivileged escape callCVE-2018-6248 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
NVIDIA GPU Display Driver (Windows nvlddmkm.sys + Linux nvidia.ko): NULL dereference in the kernel-mode layer reachableCVE-2018-6249 · NVIDIA GPU Display Driver (Windows nvlddmkm.sys + Linux nvidia.ko)High
NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Same class as the other early-2018 escape bugs: an unprivilegedCVE-2018-6250 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
NVIDIA GPU Display Driver - Windows user mode layer: The user mode driver layer lets an unprivileged user readCVE-2022-34669 · NVIDIA GPU Display Driver - Windows user mode layerHigh

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.