AI analysis
NVIDIA Infrastructure Controller for Linux contains a SQL injection flaw (CWE-89) rated 8.8 (high) that is exploitable over the network by an attacker holding low-privileged, authenticated access to the controller. The flaw is triggered by supplying crafted SQL input through the product's interfaces, which the underlying database executes without adequate sanitization. A successful exploit could lead to code execution, data tampering, denial of service, and information disclosure, with high impact on confidentiality, integrity, and availability. Organizations using this software to manage NVIDIA GPU or Linux data-center infrastructure are affected; the source data does not specify exact version ranges, so administrators should consult NVIDIA's PSIRT advisory. No public proof of concept is known, the CVE is not on CISA's KEV list, and there is no evidence of exploitation in the wild.
What to do: Review the NVIDIA PSIRT advisory for this CVE and upgrade affected Infrastructure Controller for Linux installations to the fixed version as soon as it is available. Until patched, restrict network access to the controller's management interface to trusted admin networks or VPN, and enforce least-privilege accounts since exploitation requires low-privileged authentication. Because impact can include code execution and data tampering, review the controller host and its database logs for suspicious queries or unauthorized changes if it has been exposed.
Affected
| NVIDIA Infrastructure Controller for Linux | — |
Estimated exposure
nichelikely hundreds to low thousands of installations (order of magnitude: thousands), clearly an estimate — This is specialized enterprise cluster/data-center management software deployed once per GPU cluster rather than per user and not typically internet-exposed; no public install counts or internet-scan data were available, so the estimate is…
Description
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.