SB2024022934 - Multiple vulnerabilities in NVIDIA GPU display driver for Windows and Linux
Published: February 29, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2022-42265)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the NVIDIA GPU Display Driver in the kernel mode layer (nvidia.ko). A local user can trigger an integer overflow and perform a denial of service (DoS) attack or gain access to sensitive information.
2) NULL pointer dereference (CVE-ID: CVE-2024-0075)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
3) NULL pointer dereference (CVE-ID: CVE-2024-0078)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
4) Access of Memory Location After End of Buffer (CVE-ID: CVE-2024-0074)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the NVIDIA GPU Display Driver for Linux. A local user can access a memory location after the end of the buffer and perform a denial of service (DoS) attack.
5) Execution with unnecessary privileges (CVE-ID: CVE-2024-0073)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to execution with unnecessary privileges in the kernel mode layer within the NVIDIA GPU Display Driver for Windows. A local low-privileged user can execute arbitrary code with elevated privileges.
6) Out-of-bounds write (CVE-ID: CVE-2024-0071)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error when processing untrusted input in the user mode layer within the NVIDIA GPU Display Driver for Windows. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
Remediation
Install update from vendor's website.