TI-2023-00202 Aliases CVE-2023-0208 GHSA-qh6p-7hfp-vmv9

Heap-based buffer overflow in NVIDIA DCGM

LOW 36CWE-122Published 2023-04-01 · Updated 2025-02-11

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NVIDIA DCGM for Linux contains a vulnerability in HostEngine (server component) where a user may cause a heap-based buffer overflow through the bound socket. A successful exploit of this vulnerability may lead to denial of service and data tampering.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00178 7th percentileScored 2026-11-07

Fix Fixed DCGM (NVIDIA): 3.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NVIDIA	DCGM	before 3.1.7	3.1.7	Patch available	CNA

DCGM VendorNVIDIA Affected before 3.1.7 Fixed in 3.1.7 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:nvidia:data_center_gpu_manager::::::::	before 3.1.7	Vulnerable	NVIDIA
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux

cpe:2.3:a:nvidia:data_center_gpu_manager:*:*:*:*:*:*:*:* Versions before 3.1.7 Vulnerable ·NVIDIA
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

Fix · CNA DCGM (NVIDIA) Fixed in 3.1.7

Timeline

2026-10-02 Threatist record created from CVE-2023-0208
2026-10-03 Alias added: GHSA-qh6p-7hfp-vmv9

References

Advisory 1

https://nvidia.custhelp.com/app/answers/detail/a_id/5453

TI-2022-06191 Improper input validation in NVIDIA Data Center GPU Manager CVSS 3.1MEDIUM 6.3
TI-2021-13433 NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences