SB2024022938 - Multiple vulnerabilities in NVIDIA Virtual GPU Manager
Published: February 29, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2022-42265)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the NVIDIA GPU Display Driver in the kernel mode layer (nvidia.ko). A local user can trigger an integer overflow and perform a denial of service (DoS) attack or gain access to sensitive information.
2) Execution with unnecessary privileges (CVE-ID: CVE-2024-0073)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to execution with unnecessary privileges in the kernel mode layer within the NVIDIA GPU Display Driver for Windows. A local low-privileged user can execute arbitrary code with elevated privileges.
3) Access of Memory Location After End of Buffer (CVE-ID: CVE-2024-0074)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the NVIDIA GPU Display Driver for Linux. A local user can access a memory location after the end of the buffer and perform a denial of service (DoS) attack.
4) NULL pointer dereference (CVE-ID: CVE-2024-0078)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
5) NULL pointer dereference (CVE-ID: CVE-2024-0075)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
6) Improper Authorization (CVE-ID: CVE-2024-0077)
The vulnerability allows a malicious guest to escalate privileges on the system.
The vulnerability exists due to improper authorization within the vGPU plugin when allocating resources for the guest OS. A malicious guest can escalate privileges on the system.
7) NULL pointer dereference (CVE-ID: CVE-2024-0079)
The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in the kernel mode layer. A malicious guest can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.