Multiple vulnerabilities in NVIDIA vGPU software
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2024-0126 CVE-2024-0127 CVE-2024-0128 |
| CWE-ID | CWE-20 CWE-732 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
NVIDIA vGPU Software Client/Desktop applications / Other client software |
| Vendor | nVidia |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU99272
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0126
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insufficient validation of user-supplied input. A local user can execute arbitrary code with elevated privileges.
Install update from vendor's website.
Vulnerable software versionsNVIDIA vGPU Software: 16.0 - 17.3
CPE2.3- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.0:*:*:*:*:*:*:*
- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.2:*:*:*:*:*:*:*
https://nvidia.custhelp.com/app/answers/detail/a_id/5586
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU99278
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0127
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the guest OS.
Install update from vendor's website.
Vulnerable software versionsNVIDIA vGPU Software: 16.0 - 17.3
CPE2.3- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.0:*:*:*:*:*:*:*
- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.2:*:*:*:*:*:*:*
https://nvidia.custhelp.com/app/answers/detail/a_id/5586
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Incorrect permission assignment for critical resource
EUVDB-ID: #VU99279
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-0128
CWE-ID:
CWE-732 - Incorrect Permission Assignment for Critical Resource
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the guest OS.
The vulnerability exists due to incorrect permission assignment for critical resource. A local user can execute arbitrary code on the guest OS with elevated privileges.
Install update from vendor's website.
Vulnerable software versionsNVIDIA vGPU Software: 16.0 - 17.3
CPE2.3- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.0:*:*:*:*:*:*:*
- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.1:*:*:*:*:*:*:*
- cpe:2.3:a:nvidia:nvidia_vgpu_software:16.2:*:*:*:*:*:*:*
https://nvidia.custhelp.com/app/answers/detail/a_id/5586
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
