CVE-2023-25510: 
CUDA Toolkit vulnerability analysis and mitigation

NVIDIA CUDA Toolkit SDK for Linux and Windows contains a NULL pointer dereference vulnerability (CVE-2023-25510) discovered in the cuobjdump tool. The vulnerability was disclosed on April 21, 2023, affecting all versions of NVIDIA CUDA Toolkit prior to version 12.1.1. This security issue impacts both Linux and Windows operating systems (NVIDIA Advisory, NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 3.3 (LOW). The vulnerability vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, indicating that it requires local access and user interaction to exploit (NVIDIA Advisory).

A successful exploitation of this vulnerability can result in a limited denial of service when a local user runs the cuobjdump tool against a malformed binary (NVIDIA Advisory).

NVIDIA has released a security update to address this vulnerability. Users are advised to upgrade to CUDA Toolkit version 12.1 Update 1 or later. The update is available for download from the CUDA Toolkit Downloads page (NVIDIA Advisory).

The vulnerability was reported by security researchers zz zr and Zhaozixi105, who were acknowledged by NVIDIA for their contribution to discovering this security issue (NVIDIA Advisory).