Home » Database

AVID-2026-R1188

Description

Vulnerability CVE-2023-25514

Details

NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in cuobjdump, where an attacker may cause an out-of-bounds read by tricking a user into running cuobjdump on a malformed input file. A successful exploit of this vulnerability may lead to limited denial of service, code execution, and limited information disclosure.

Reason for inclusion in AVID: CVE-2023-25514 describes a vulnerability in NVIDIA CUDA Toolkit’s cuobjdump that can cause an out-of-bounds read leading to limited DoS, code execution, and information disclosure. CUDA Toolkit is a core software component widely used in general-purpose AI stacks for building, training, and deploying models (GP AI pipelines, drivers, runtimes, and tooling). This makes it a software supply-chain component relevant to AI systems. The vulnerability is security-related and affects a software package used in AI workflows, fulfilling the AVID criteria.

References

Affected or Relevant Artifacts

  • Developer: NVIDIA
  • Deployer: NVIDIA
  • Artifact Details:
TypeName
SystemNVIDIA CUDA Toolkit

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Base Score5.3
Base Severity🟠 Medium
Attack VectorLOCAL
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🟢 Low
Integrity Impact🟢 Low
Availability Impact🟢 Low

CWE

IDDescription
CWE-125CWE-125 Out-of-bounds Read

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2023-04-22
  • Version: 0.3.3
  • AVID Entry