CVE-2024-0122: NVIDIA Licensing Service DoS Vulnerability

CVE-2024-0122 Overview

CVE-2024-0122 is a Missing Authorization vulnerability (CWE-862) affecting the NVIDIA Delegated Licensing Service across all appliance platforms. This vulnerability allows an attacker to cause unauthorized actions within the licensing service, potentially resulting in partial denial of service and disclosure of confidential information.

The flaw stems from improper authorization checks within the Delegated Licensing Service, enabling adjacent network attackers to perform actions without proper validation of their permissions.

Critical Impact

Successful exploitation may lead to partial denial of service conditions and confidential information disclosure on NVIDIA appliance platforms running the Delegated Licensing Service.

Affected Products

• NVIDIA Delegated Licensing Service (all appliance platforms)

Discovery Timeline

• November 23, 2024 - CVE-2024-0122 published to NVD
• November 23, 2024 - Last updated in NVD database

Technical Details for CVE-2024-0122

Vulnerability Analysis

The vulnerability exists in the NVIDIA Delegated Licensing Service component and is classified under CWE-862 (Missing Authorization). This weakness occurs when the software does not perform an authorization check when an actor attempts to access a resource or perform an action.

The attack can be initiated from an adjacent network position without requiring authentication or user interaction. This makes it accessible to attackers who have gained a foothold on the same network segment as the vulnerable appliance. The potential impact includes unauthorized access to confidential licensing information and the ability to disrupt service availability.

Root Cause

The root cause is a Missing Authorization vulnerability (CWE-862), where the NVIDIA Delegated Licensing Service fails to properly verify that a requesting entity has the necessary privileges before processing sensitive operations. This authorization gap allows unauthorized actors to perform actions that should be restricted to authenticated and authorized users only.

Attack Vector

The attack vector requires adjacent network access, meaning an attacker must be on the same network segment as the vulnerable NVIDIA appliance. The attack complexity is low, requires no privileges, and needs no user interaction. Once positioned on the adjacent network, an attacker can send crafted requests to the Delegated Licensing Service to exploit the missing authorization checks.

The vulnerability does not require authentication, allowing any adjacent network entity to potentially exploit it. Attackers can leverage this weakness to extract confidential information from the licensing service or cause service disruption through unauthorized actions.

Detection Methods for CVE-2024-0122

Indicators of Compromise

• Unusual or unauthorized requests to the NVIDIA Delegated Licensing Service from unexpected network sources
• Anomalous licensing service behavior or unexpected service restarts
• Unexpected information disclosure in licensing service logs or responses
• Suspicious network traffic patterns targeting licensing service ports from adjacent network segments

Detection Strategies

• Monitor NVIDIA Delegated Licensing Service logs for unauthorized access attempts or unusual request patterns
• Implement network segmentation monitoring to detect lateral movement toward appliance platforms
• Deploy intrusion detection signatures for anomalous licensing service traffic
• Review authentication and authorization failure events on NVIDIA appliances

Monitoring Recommendations

• Enable comprehensive logging on NVIDIA Delegated Licensing Service and forward to SIEM for analysis
• Establish baseline network behavior for licensing service communications
• Configure alerts for access attempts from non-authorized network segments
• Monitor for service availability degradation that may indicate exploitation attempts

How to Mitigate CVE-2024-0122

Immediate Actions Required

• Review the NVIDIA Customer Support Answer for official remediation guidance
• Implement network segmentation to restrict adjacent network access to NVIDIA appliances
• Audit current network access controls for Delegated Licensing Service endpoints
• Monitor licensing service activity for signs of exploitation while preparing to apply patches

Patch Information

NVIDIA has released security guidance for this vulnerability. Administrators should consult the official NVIDIA Security Advisory for specific patch information, affected version details, and remediation steps. Apply the vendor-recommended updates to all affected NVIDIA appliance platforms running the Delegated Licensing Service.

Workarounds

• Implement strict network segmentation to limit adjacent network access to NVIDIA appliances
• Deploy firewall rules to restrict which network entities can communicate with the Delegated Licensing Service
• Enable enhanced logging and monitoring until patches can be applied
• Consider temporarily isolating affected appliances if immediate patching is not feasible