NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited code execution, some denial of service, escalation of privileges, and limited impacts to both data confidentiality and integrity.

Threat-Mapped Scoring

Score: 1.9

Priority: P3 - Important (Medium)

• S9 – Sabotage of System/App
• S10 – Denial of Service (+0.1 bonus)

EPSS

Score: 0.00515
Percentile: 0.65641

CVSS Scoring

Mapped CWE(s)

• CWE-20 : Improper Input Validation
• CWE-755 : Improper Handling of Exceptional Conditions
• CWE-787 : Out-of-bounds Write

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1562.003 : Impair Command History Logging
  Kill Chain: defense-evasion
• T1574.006 : Dynamic Linker Hijacking
  Kill Chain: persistence
• T1574.007 : Path Interception by PATH Environment Variable
  Kill Chain: persistence
• T1027 : Obfuscated Files or Information
  Kill Chain: defense-evasion
• T1539 : Steal Web Session Cookie
  Kill Chain: credential-access
• T1036.001 : Invalid Code Signature
  Kill Chain: defense-evasion
• T1553.002 : Code Signing
  Kill Chain: defense-evasion

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:nvidia:data_center_gpu_manager:*:*:*:*:*:*:*:*

← Back to Home