Connectx 5
Monthly
Improper access control in the firmware control-register interface of NVIDIA ConnectX (ConnectX-5 plus GA, LTS23 and LTS24 firmware branches) and BlueField (GA, LTS23, LTS24) adapters allows a user who already holds an SR-IOV virtual function (VF) on the device to send a crafted command to the firmware and disturb the register interface, producing a denial-of-service condition on the affected adapter and, per the scope-change vector, potentially on components beyond it. The issue is reachable from an adjacent network position with low complexity but requires a legitimate VF foothold (PR:L), and the impact is availability-only - no confidentiality or integrity loss is described. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and NVIDIA's own advisory is the authoritative source for fixed firmware releases. EPSS and KEV signals are absent from the supplied intelligence.
Improper access control in the firmware control-register interface of NVIDIA ConnectX (ConnectX-5 plus GA, LTS23 and LTS24 firmware branches) and BlueField (GA, LTS23, LTS24) adapters allows a user who already holds an SR-IOV virtual function (VF) on the device to send a crafted command to the firmware and disturb the register interface, producing a denial-of-service condition on the affected adapter and, per the scope-change vector, potentially on components beyond it. The issue is reachable from an adjacent network position with low complexity but requires a legitimate VF foothold (PR:L), and the impact is availability-only - no confidentiality or integrity loss is described. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and NVIDIA's own advisory is the authoritative source for fixed firmware releases. EPSS and KEV signals are absent from the supplied intelligence.