CVE-2025-23258 Overview
CVE-2025-23258 affects NVIDIA DOCA, specifically the collectx-dpeserver Debian package for the arm64 architecture. The vulnerability allows an attacker with low privileges on a local system to escalate privileges. Exploitation requires user interaction and can result in a full compromise of confidentiality, integrity, and availability on the affected host. The root weakness is classified under [CWE-732: Incorrect Permission Assignment for Critical Resource]. NVIDIA has published a support advisory documenting the flaw and remediation.
Critical Impact
Successful exploitation grants an attacker elevated privileges on systems running the affected collectx-dpeserver package, enabling arbitrary actions under a higher-privileged security context.
Affected Products
- NVIDIA DOCA collectx-dpeserver Debian package
- arm64 architecture builds
- See the NVIDIA Support Article for exact affected versions
Discovery Timeline
- 2025-09-04 - CVE-2025-23258 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23258
Vulnerability Analysis
The vulnerability resides in the collectx-dpeserver Debian package distributed with NVIDIA DOCA on arm64 systems. DOCA is NVIDIA's software framework for BlueField data processing units (DPUs), and collectx-dpeserver runs as a telemetry data plane service. The flaw is a local privilege escalation issue mapped to [CWE-732], which covers incorrect permission assignment for critical resources. An attacker with limited local access can leverage improperly assigned permissions on a file, directory, or resource controlled by the service to gain elevated privileges. Exploitation requires user interaction, indicating that a legitimate action by a higher-privileged user or process is needed to trigger the escalation path.
Root Cause
The root cause is incorrect permission assignment on a critical resource used by the collectx-dpeserver service. When file, directory, or IPC permissions are set more permissively than required, a low-privileged local user can modify resources that a privileged process later reads, executes, or trusts. NVIDIA has not published low-level exploitation details, and no verified proof-of-concept code is publicly available.
Attack Vector
The attack is local. An adversary must already possess low-privileged shell access on the target arm64 system running DOCA. The attacker manipulates a resource protected by weak permissions, then relies on a user-triggered action to have the service consume or execute the tampered resource under an elevated context. Successful exploitation yields high impact to confidentiality, integrity, and availability.
No public exploit code is available for this issue. Refer to the NVIDIA Support Article and the NVD entry for further technical guidance.
Detection Methods for CVE-2025-23258
Indicators of Compromise
- Unexpected modifications to files, directories, or sockets owned or used by the collectx-dpeserver service.
- Newly created SUID binaries or world-writable files within DOCA installation paths.
- Processes spawned by collectx-dpeserver running with elevated privileges that execute shells or user-controlled binaries.
Detection Strategies
- Audit filesystem permissions on all resources associated with the collectx-dpeserver package and flag deviations from the vendor-shipped defaults.
- Monitor process ancestry on arm64 DOCA hosts for child processes of collectx-dpeserver that do not match expected telemetry workflows.
- Correlate local logon events from low-privileged accounts with subsequent privileged process executions on the same host.
Monitoring Recommendations
- Enable Linux audit rules (auditd) on DOCA-managed BlueField DPUs to log execve, chmod, and chown calls against DOCA paths.
- Alert on any writes to configuration files or scripts consumed by collectx-dpeserver from non-root users.
- Track package version drift on arm64 hosts to confirm patched builds remain installed after system updates.
How to Mitigate CVE-2025-23258
Immediate Actions Required
- Inventory all arm64 systems running NVIDIA DOCA and identify hosts with the collectx-dpeserver Debian package installed.
- Apply the fixed collectx-dpeserver package version referenced in the NVIDIA Support Article.
- Restrict local shell access on DPU management hosts to trusted administrative accounts only.
- Review and tighten filesystem permissions on DOCA service directories to match vendor recommendations.
Patch Information
NVIDIA has published remediation guidance in the vendor advisory at NVIDIA Answer ID 5655. Administrators should upgrade the collectx-dpeserver Debian package for arm64 to the fixed release identified by NVIDIA. Confirm the installed package version after patching using dpkg -l collectx-dpeserver.
Workarounds
- If patching is not immediately possible, stop and disable the collectx-dpeserver service on affected hosts until the update can be applied.
- Remove or restrict local access for non-administrative users on BlueField DPU management systems.
- Enforce strict file permissions on DOCA installation directories, ensuring no world-writable files exist within service paths.
# Verify installed package version and inspect service permissions
dpkg -l | grep collectx-dpeserver
sudo find /opt/mellanox /opt/nvidia -xdev \( -perm -0002 -o -perm -4000 \) -ls
sudo systemctl status collectx-dpeserver
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
