CVE-2021-23217

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to instantiate a DMA write operation only within a specific time window timed to corrupt code execution, which may impact confidentiality, integrity, or availability. The scope impact may extend to other components.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
NVIDIA	NVIDIA GPU and Tegra hardware	Maxwell, GP100, Tegra X1, Tegra X1+, Tegra TX2

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5263Vendor Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5263Vendor Advisory

Timeline

Published: Nov 20, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-232187.5When running with FIPS mode enabled, Mirantis Container Runtime 20.10.8 leaks memory during TLS Handshakes which could be abused to cause a CVE-2021-232194.1NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller, which may allow a user with elevated privileges to ac CVE-2021-23228.8Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low CVE-2021-232225.9A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification a CVE-2021-232237.8Improper initialization for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enabl CVE-2021-232255.4Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web script or HTML in the "new_username" field CVE-2021-232278.8Cross-Site Request Forgery (CSRF) vulnerability in Alexander Fuchs PHP Everywhere plugin <= 2.0.2 versions.CVE-2021-232286.1DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET R CVE-2021-23235.9Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Flex-Branch). Supported CVE-2021-232304.3A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to mod CVE-2021-232339.8Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session CVE-2021-232367.5Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be reboot