NVIDIA Riva Vulnerabilities Let Attackers Escalate Privileges

The update, detailed in a March 10, 2025 security bulletin, impacts all Linux deployments running Riva versions ≤2.18.0 and follows coordinated disclosure with Trend Micro’s David Fiser and Alfredo Oliveira researchers. NVIDIA has issued a significant software update for its Riva speech AI platform, releasing version 2.19.0 to resolve two high-severity vulnerabilities (CVE-2025-23242 and CVE-2025-23243) involving improper access control mechanisms. Both vulnerabilities stem from insufficient validation of gRPC request headers in Riva’s microservice architecture, as confirmed by NVIDIA’s Product Security Incident Response Team (PSIRT). NVIDIA plans to introduce automated vulnerability scanning for Riva model repositories in Q2 2025 as part of its enhanced security roadmap. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. NVIDIA mandates an immediate upgrade to Riva 2.19.0, introducing enhanced role-based access control (RBAC) policies and hardened gRPC authentication protocols. Organizations using custom voice fonts or domain-specific language models should validate acoustic properties post-upgrade, as the security patches modify low-level audio processing threads. CVE-2025-23243 (CVSS 6.5) presents a more limited but still critical risk profile, enabling unauthenticated actors to trigger denial-of-service conditions or tamper with text normalization outputs in neural machine translation (NMT) services. NVIDIA’s advisory emphasizes that these vulnerabilities affect all prior Riva versions, including Long-Term Support (LTS) branches. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.

This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 12 Mar 2025 13:25:17 +0000

Cyber News related to NVIDIA Riva Vulnerabilities Let Attackers Escalate Privileges

NVIDIA Riva Vulnerabilities Let Attackers Escalate Privileges - The update, detailed in a March 10, 2025 security bulletin, impacts all Linux deployments running Riva versions ≤2.18.0 and follows coordinated disclosure with Trend Micro’s David Fiser and Alfredo Oliveira researchers. NVIDIA has ...
3 months ago Cybersecuritynews.com CVE-2025-23242

NVIDIA Riva Vulnerabilities Exposes Enable Authorized Access to Cloud Environments - This creates a false sense of security, as attackers can still abuse services or pivot to internal systems through poorly isolated Triton Inference Server instances. Trend Micro researchers uncovered two vulnerabilities-CVE-2025-23242 and ...
1 month ago Cybersecuritynews.com CVE-2025-23242

Nvidia sued after video call mistake showed 'stolen' data - According to a lawsuit filed against tech giant Nvidia, senior staff member Mohammad Moniruzzaman made this error with disastrous consequences. In the course of it, Valeo claims he accidentally displayed a file proving he stole its tech secrets. The ...
1 year ago Bbc.com

Cohesity partners with NVIDIA to harness the power of generative AI - Cohesity announced a collaboration with NVIDIA to help organizations safely unlock the power of generative AI and data using the recently announced NVIDIA NIM microservices and by integrating NVIDIA AI Enterprise into the Cohesity Gaia platform. ...
1 year ago Helpnetsecurity.com

Palo Alto Networks Prevents Data Loss at Enterprise Scale with NVIDIA - With NVIDIA accelerated computing and AI software, cybersecurity leaders like Palo Alto Networks can safeguard vast amounts of sensitive information with unprecedented speed and accuracy, ushering in a new era of AI-driven data protection. The ...
8 months ago Paloaltonetworks.com

Nvidia To Build Network Of AI Chip Plants In Japan - Nvidia chief Jensen Huang says company to work with local companies to build network of AI chip plants in Japan. Nvidia is to collaborate with local companies to build a network of semiconductor manufacturing facilities in Japan to meet demand for ...
1 year ago Silicon.co.uk

Nvidia Targets Insider Threats with Digital Fingerprinting Technology - Nvidia recently announced a new technology to help detect and prevent insider threats. The tech, known as Digital Fingerprinting, is designed to detect unauthorized attempts to access sensitive data or systems within a company's network. The ...
2 years ago Csoonline.com

NVIDIA’s Incomplete Patch for Critical Flaw Lets Attackers Steal AI Model Data - Organizations using NVIDIA Container Toolkit or Docker on Linux are at risk, especially those running AI workloads like machine learning for healthcare, finance, or autonomous systems. A critical vulnerability in NVIDIA’s Container Toolkit, ...
2 months ago Cybersecuritynews.com CVE-2024-0132

Multiple NVIDIA CUDA Toolkit Vulnerabilities Let Attackers Trigger DoS - Attackers could crash analysis tools or leak memory contents by distributing weaponized cubin files – a critical risk for AI development teams sharing pre-trained models. These vulnerabilities, spanning the cuobjdump and nvdisasm utilities, expose ...
4 months ago Cybersecuritynews.com

Building Data Center Infrastructure for the AI Revolution  - This is part two of a multi-part blog series on AI. Part one, Why 2024 is the Year of AI for Networking, discussed Cisco's AI networking vision and strategy. This blog will focus on evolving data center network infrastructure for supporting AI/ML ...
1 year ago Feedpress.me

Nvidia Promises Japan AI Support Amidst Heavy Demand - Nvidia chief executive Jensen Huang says company will try to prioritise Japan AI requirements amidst heavy worldwide demand. Nvidia chief executive Jensen Huang said the company would do its best to prioritise Japan for artificial intelligence chips ...
1 year ago Silicon.co.uk

NVIDIA NeMo Framework Vulnerability Let Attackers Execute Remote Code - A successful exploit of this vulnerability might lead to code execution and data tampering,” states the official security bulletin. “NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted ...
1 month ago Cybersecuritynews.com

CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
1 year ago Securityaffairs.com

Dual Privilege Escalation Chain: Exploiting Monitoring and Service Mesh Configurations and Privileges in GKE to Gain Unauthorized Access in Kubernetes - While each issue might not result in significant damage on its own, when combined they create an opportunity for an attacker who already has access to a Kubernetes cluster to escalate their privileges. If an attacker has the ability to execute in the ...
1 year ago Unit42.paloaltonetworks.com

Strobes 2023 Pentesting Recap: Trends, Stats, and How PTaaS is Transforming Cybersecurity - This article covers some amazing statistics on what category of vulnerabilities we commonly report across 100s of customers, and how we reduce compliance times and turn around time to reporting critical vulnerabilities. In a different article, we ...
1 year ago Securityboulevard.com

Cyber Security News Letter: Key Updates on Attacks, Vulnerabilities, & Data Breaches - Attackers are actively exploiting critical vulnerabilities in on-premises Microsoft Exchange and SharePoint servers, using advanced NTLM relay and credential theft techniques for persistent access. Researchers have detected a new JScript loader ...
2 months ago Cybersecuritynews.com CVE-2025-24054

US House 'Asks Intel, Nvidia, Micron CEOs' To Testify On China - US House of Representatives China committee asks chief executives of Intel, Nvidia, Micron to testify as international tensions mount. The chief executives of Intel, Nvidia and Micron have been asked to testify before the US House of Representatives' ...
1 year ago Silicon.co.uk

Five AI topics to discuss with your CEO - At Cisco Live EMEA in Amsterdam in early February, you couldn't swing an Ethernet cable without hitting someone who was talking about it. Even though AI comes with especially useful applications and some very practical downsides, it's important to ...
1 year ago Feedpress.me

Why CVEs Are an Incentives Problem - I've been thinking about some of these unintended consequences in the context of a growing problem faced by all of us in cybersecurity: how a fast-rising tide of software vulnerabilities tracked as common vulnerabilities and exposures - are reported ...
1 year ago Darkreading.com

CVE-2025-23242 - NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, or information disclosure. ...
3 months ago CVE-2025-23243

Don't get hacked! Apply the right vulnerability metrics to Kubernetes scans - As you read this, I'd like you to keep in mind that CVSS was never intended to be that end-all software vulnerability scoring system. Doesn't reflect actual risk - CVSS provides a base score that represents the inherent severity of a vulnerability in ...
1 year ago Securityboulevard.com

CVE-2025-23243 - NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data tampering or denial of service. ...
3 months ago CVE-2025-23243

Over 100 WordPress Repository Plugins Affected by Shortcode-based Stored Cross-Site Scripting - On August 14, 2023, the Wordfence Threat Intelligence team began a research project to find Stored Cross-Site Scripting via Shortcode vulnerabilities in WordPress repository plugins. We found over 100 vulnerabilities across 100 plugins which affect ...
1 year ago Wordfence.com

Misconfiguration and vulnerabilities biggest risks in cloud security: Report - The two biggest cloud security risks continue to be misconfigurations and vulnerabilities, which are being introduced in greater numbers through software supply chains, according to a report by Sysdig. While zero trust is a top priority, data showed ...
2 years ago Csoonline.com Hunters

Creating a formula for effective vulnerability prioritization - In this Help Net Security interview, Michael Gorelik, CTO and Head of Malware Research at Morphisec, provides insights into the business impact of vulnerabilities. Gorelik discusses challenges posed by regulatory frameworks, incomplete asset ...
1 year ago Helpnetsecurity.com