SB2019080644 - Out-of-bounds write in NVIDIA Windows GPU Display Driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2019-5685)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the "NVWGF2UMX_CFG.DLL" driver in "DCL_INDEXABLETEMP" function. A remote attacker can create a specially crafted shader file, trigger out-of-bounds write and execute arbitrary code on the target system or perform a denial of service attack.

This vulnerability can be triggered from VMware guest, affecting VMware host.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://nvidia.custhelp.com/app/answers/detail/a_id/4841
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0812