Multiple vulnerabilities in NVIDIA GPU display driver for Windows and Linux
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 6 |
| CVE-ID | CVE-2022-42265 CVE-2024-0075 CVE-2024-0078 CVE-2024-0074 CVE-2024-0073 CVE-2024-0071 |
| CWE-ID | CWE-190 CWE-476 CWE-788 CWE-250 CWE-787 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
NVIDIA Windows GPU Display Driver Client/Desktop applications / Virtualization software NVIDIA Linux GPU Display Driver Hardware solutions / Drivers |
| Vendor | nVidia |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
1) Integer overflow
EUVDB-ID: #VU86927
Risk: Low
CVSSv4.0: 4.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-42265
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the NVIDIA GPU Display Driver in the kernel mode layer (nvidia.ko). A local user can trigger an integer overflow and perform a denial of service (DoS) attack or gain access to sensitive information.
Install updates from vendor's website.
Vulnerable software versionsNVIDIA Windows GPU Display Driver: before 474.82
NVIDIA Linux GPU Display Driver: before 470.239.06
CPE2.3- cpe:2.3:a:nvidia:nvidia_windows_gpu_display_driver:*:*:*:*:*:*:*:*
- cpe:2.3:h:nvidia:nvidia_linux_gpu_display_driver:*:*:*:*:*:*:*:*
https://nvidia.custhelp.com/app/answers/detail/a_id/5520
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) NULL pointer dereference
EUVDB-ID: #VU86926
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0075
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNVIDIA Windows GPU Display Driver: before 474.82
NVIDIA Linux GPU Display Driver: before 470.239.06
CPE2.3- cpe:2.3:a:nvidia:nvidia_windows_gpu_display_driver:*:*:*:*:*:*:*:*
- cpe:2.3:h:nvidia:nvidia_linux_gpu_display_driver:*:*:*:*:*:*:*:*
https://nvidia.custhelp.com/app/answers/detail/a_id/5520
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) NULL pointer dereference
EUVDB-ID: #VU86925
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0078
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsNVIDIA Windows GPU Display Driver: before 474.82
NVIDIA Linux GPU Display Driver: before 470.239.06
CPE2.3- cpe:2.3:a:nvidia:nvidia_windows_gpu_display_driver:*:*:*:*:*:*:*:*
- cpe:2.3:h:nvidia:nvidia_linux_gpu_display_driver:*:*:*:*:*:*:*:*
https://nvidia.custhelp.com/app/answers/detail/a_id/5520
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Access of Memory Location After End of Buffer
EUVDB-ID: #VU86924
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0074
CWE-ID:
CWE-788 - Access of Memory Location After End of Buffer
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the NVIDIA GPU Display Driver for Linux. A local user can access a memory location after the end of the buffer and perform a denial of service (DoS) attack.
Install updates from vendor's website.
Vulnerable software versionsNVIDIA Linux GPU Display Driver: before 470.239.06
CPE2.3 External linkshttps://nvidia.custhelp.com/app/answers/detail/a_id/5520
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Execution with unnecessary privileges
EUVDB-ID: #VU86923
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0073
CWE-ID:
CWE-250 - Execution with Unnecessary Privileges
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to execution with unnecessary privileges in the kernel mode layer within the NVIDIA GPU Display Driver for Windows. A local low-privileged user can execute arbitrary code with elevated privileges.
Install updates from vendor's website.
Vulnerable software versionsNVIDIA Windows GPU Display Driver: before 474.82
CPE2.3 External linkshttps://nvidia.custhelp.com/app/answers/detail/a_id/5520
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Out-of-bounds write
EUVDB-ID: #VU86922
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0071
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
Description The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing untrusted input in the user mode layer within the NVIDIA GPU Display Driver for Windows. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
Install updates from vendor's website.
Vulnerable software versionsNVIDIA Windows GPU Display Driver: before 474.82
CPE2.3 External linkshttps://nvidia.custhelp.com/app/answers/detail/a_id/5520
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
