CVE-2023-25523: 
CUDA Toolkit vulnerability analysis and mitigation

NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability (CVE-2023-25523) in the nvdisasm binary file that was disclosed on June 29, 2023. The vulnerability affects all versions of NVIDIA CUDA Toolkit prior to version 12.2 on both Linux and Windows operating systems (NVIDIA Advisory).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) that can be triggered when a malformed ELF file is provided to the nvdisasm binary. The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, indicating local access, low attack complexity, no privileges required, and user interaction required (NVIDIA Advisory).

A successful exploitation of this vulnerability may lead to a partial denial of service in the affected systems. The impact is limited to availability with no effect on confidentiality or integrity (NVIDIA Advisory).

NVIDIA has released CUDA Toolkit v12.2 to address this vulnerability. Users are recommended to upgrade to this version or later. The update is available from the CUDA Toolkit Downloads page. Earlier software releases of this product are also affected, and users should upgrade to the latest release version (NVIDIA Advisory).

The vulnerability was discovered and reported by security researcher Jifan Xiao (NVIDIA Advisory).