SB2024061008 - Multiple vulnerabilities in NVIDIA GPU display driver for Windows and Linux

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Untrusted pointer dereference (CVE-ID: CVE-2024-0091)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to untrusted pointer dereference. A local user can execute a driver API to execute arbitrary code with elevated privileges.

2) Improper Initialization (CVE-ID: CVE-2024-0089)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper initialization. A local user can run a specially crafted application to gain access to information from a previous client or another process and execute arbitrary code.

3) Out-of-bounds write (CVE-ID: CVE-2024-0090)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error. A local user can trigger an out-of-bounds write and execute arbitrary code with escalated privileges.

4) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2024-0092)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an improper check or improper handling of exception conditions. A local user can perform a denial of service (DoS)  attack.

Remediation

Install update from vendor's website.

References

• https://nvidia.custhelp.com/app/answers/detail/a_id/5551