NVIDIA Omniverse Kit Create/Audio2Face/Isaac Sim/View/Code/Machinima injection

Summaryinfo

A vulnerability classified as very critical was found in NVIDIA Omniverse Kit. This issue affects some unknown processing of the component Create/Audio2Face/Isaac Sim/View/Code/Machinima. Such manipulation leads to injection. This vulnerability is listed as CVE-2022-42268. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in NVIDIA Omniverse Kit (version unknown). Affected by this issue is an unknown function of the component Create/Audio2Face/Isaac Sim/View/Code/Machinima. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow executable Python code to be embedded in Universal Scene Description (USD) files to customize all aspects of a scene. If a user opens a USD file that contains embedded Python code in one of these applications, the embedded Python code automatically runs with the privileges of the user who opened the file. As a result, an unprivileged remote attacker could craft a USD file containing malicious Python code and persuade a local user to open the file, which may lead to information disclosure, data tampering, and denial of service.

The weakness was presented 01/13/2023. The advisory is shared for download at nvidia.custhelp.com. This vulnerability is handled as CVE-2022-42268 since 10/03/2022. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/13/2023). The MITRE ATT&CK project declares the attack technique as T1055.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• NVIDIA

Name

• Omniverse Kit

License

• commercial

Website

• Vendor: https://www.nvidia.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion