EUVD-2025-208964
GHSA-c4x2-4777-gmwq
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
3Description
NVIDIA SNAP-4 Container contains a vulnerability in the VIRTIO-BLK component where a malicious guest VM may cause use of out-of-range pointer offset by sending crafted messages. A successful exploit of this vulnerability may lead to a denial of service of the DPA and impact the availability of storage to other VMs.
Analysis
NVIDIA SNAP-4 Container contains a use-of-out-of-range pointer offset vulnerability in the VIRTIO-BLK component that allows a malicious guest VM to trigger memory corruption and denial of service. The vulnerability affects NVIDIA SNAP-4 Container across all versions as indicated by the CPE string. A successful exploit results in denial of service to the DPA (Data Processing Appliance) and impacts storage availability to other VMs, though no code execution or information disclosure is possible. There is no evidence of active exploitation in the wild (KEV status indicates none), and the CVSS score of 6.8 reflects moderate severity with high availability impact but limited exploitability due to requiring adjacent network access and user privileges.
Technical Context
VIRTIO-BLK is a virtual block device interface used in virtualized environments to provide storage access to guest virtual machines. The vulnerability exists in NVIDIA's SNAP-4 Container implementation, which is a containerized environment for DPA appliances. The root cause is classified under CWE-823 (Use of Out-of-range Pointer Offset), indicating that crafted messages from a malicious guest VM can cause pointer arithmetic to reference invalid memory locations. This is a memory safety issue where insufficient bounds checking on pointer offset calculations allows an attacker to access arbitrary memory regions within the VIRTIO-BLK handler, leading to memory corruption. The affected product is NVIDIA SNAP-4 Container (all versions per CPE: cpe:2.3:a:nvidia:snap-4_container:*:*:*:*:*:*:*:*).
Affected Products
NVIDIA SNAP-4 Container is affected across all versions as specified in the CPE string (cpe:2.3:a:nvidia:snap-4_container:*:*:*:*:*:*:*:*). The vulnerability impacts the VIRTIO-BLK component within SNAP-4 Container environments. For specific patch availability and version guidance, refer to the NVIDIA security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5744 and the official CVE record at https://www.cve.org/CVERecord?id=CVE-2025-33215.
Remediation
Apply the security update provided by NVIDIA for SNAP-4 Container through the official advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5744. Until patches can be deployed, implement network segmentation to restrict guest VM communication and limit the blast radius of a potential attack by isolating DPA appliances in secured network zones. Additionally, restrict guest VM access to VIRTIO-BLK operations where possible through hypervisor-level access controls, and monitor DPA systems for unexpected service restarts or availability issues that may indicate exploitation attempts. Prioritize patching in environments where guest VMs are not fully trusted or managed by different administrative domains.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today