AVID-2026-R1010

Description

Vulnerability CVE-2022-28199

Details

NVIDIA’s distribution of the Data Plane Development Kit (MLNX_DPDK) contains a vulnerability in the network stack, where error recovery is not handled properly, which can allow a remote attacker to cause denial of service and some impact to data integrity and confidentiality.

Reason for inclusion in AVID: CVE-2022-28199 describes a vulnerability in NVIDIA’s Data Plane Development Kit (MLNX_DPDK) network stack that can cause remote denial of service and impact data integrity/confidentiality. MLNX_DPDK is a software component used in AI infrastructure (e.g., NVIDIA FLARE) and other AI deployments for packet processing, making this a software supply-chain issue relevant to AI systems. The vulnerability is CVE-listed with explicit impact and references, satisfying the security/vulnerability criteria. Evidence is provided in the CVE entry and references.

References

• NVD entry
• https://nvidia.custhelp.com/app/answers/detail/a_id/5389
• http://www.openwall.com/lists/oss-security/2022/09/06/2
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-mlx5-jbPCrqD8

Affected or Relevant Artifacts

• Developer: NVIDIA
• Deployer: NVIDIA
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2022-09-01
• Version: 0.3.3
• AVID Entry