CVE-2022-21822: Allocation of Resources Without Limits or Throttling in nvflare
Summary
CVE-2022-21822: Allocation of Resources Without Limits or Throttling in nvflare. Affects nvflare versions < 2.0.16. Fixed in 2.0.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NVIDIA FLARE is an administrative interface that provides management capabilities for NVIDIA systems. It allows users to allocate and control resources for various tasks. However, a vulnerability has been discovered in the Admin Interface of NVIDIA FLARE that allows unauthorized attackers to cause an allocation of resources without limits or throttling. This can lead to system unavailability and potential disruption of services.
Vulnerability Detail
The vulnerability in NVIDIA FLARE's Admin Interface allows attackers to bypass resource allocation limits and throttling mechanisms. By exploiting this vulnerability, an attacker can exhaust system resources, leading to system unavailability. This can result in denial of service (DoS) attacks and disrupt the normal functioning of the system. The vulnerability affects all versions of NVIDIA FLARE prior to 2.0.16.
How To Fix
Minimum fixed version
2.0.16
This is the first release that contains the fix.
pip install --upgrade "nvflare==2.0.16"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to version 2.0.16 is not immediately feasible, users can apply the changes made in the following commits to any version of NVIDIA FLARE without adverse effects:
- Commit 1: [link to commit 1]
- Commit 2: [link to commit 2]
By applying these changes, the vulnerability can be mitigated until a proper update can be performed.
Conclusion
The vulnerability in NVIDIA FLARE's Admin Interface allows attackers to bypass resource allocation limits and cause system unavailability. It is recommended to update to version 2.0.16 or later to fix this vulnerability. If immediate updating is not possible, applying the mentioned changes can provide temporary mitigation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nvflare →
FAQ
The vulnerability allows attackers to cause an allocation of resources without limits or throttling, which can lead to system unavailability and potential disruption of services.
All versions of NVIDIA FLARE prior to 2.0.16 are affected by this vulnerability.
To fix this vulnerability, update your NVIDIA FLARE installation to version 2.0.16 or later.
If updating to version 2.0.16 is not immediately feasible, you can apply the changes mentioned in the workaround section to mitigate the vulnerability.
You can find more information about this vulnerability in the provided links to the GitHub advisory and commits.
References
Related vulnerabilities
Recent vulnerabilities recorded for nvflare.
