GPU VulnDB

Database/NVIDIA / GPU stack

NVIDIA Mellanox OS, ONYX, Skyway, MetroX-2/MetroX-3 XC: A crafted URI causes CGI path traversal in the switch web

CVE-2024-0113NVIDIA / GPU stackcurated

Impact

A crafted URI causes CGI path traversal in the switch web interface, reaching privilege escalation and information disclosure on the switch itself. These are the InfiniBand and Ethernet switches carrying your east-west training traffic and, on MetroX, your inter-site links.

Who can reach it

Network, requires the switch web management interface to be reachable and a user to follow a crafted URI. Switch management planes are usually far more reachable inside the datacenter than operators assume.

What to do

Upgrade the switch OS per bulletin 5563. Cost: a switch OS upgrade means a reboot and a link flap - on a fat-tree fabric plan it leaf-by-leaf with ECMP draining, or you take collective jobs down. Disable the web interface entirely and manage via CLI/gNMI if you can.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-0113https://github.com/NVIDIA/product-security/tree/main/2024/5563

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.