Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU86927
Risk: Low
CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-42265
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the NVIDIA GPU Display Driver in the kernel mode layer (nvidia.ko). A local user can trigger an integer overflow and perform a denial of service (DoS) attack or gain access to sensitive information.
Update the affected package kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.5
Public Cloud Module: 15-SP5
Basesystem Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP5
SUSE Linux Enterprise Server 15: SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP5
SUSE Linux Enterprise Desktop 15: SP5
openSUSE Leap: 15.5
nvidia-open-driver-G06-signed-kmp-64kb: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-64kb-debuginfo: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-64kb-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-default: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-default-debuginfo: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-default-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-debugsource: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-azure-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-azure: before 550.54.14_k5.14.21_150500.33.34-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-azure-debuginfo: before 550.54.14_k5.14.21_150500.33.34-150500.3.36.1
kernel-firmware-nvidia-gspx-G06: before 550.54.14-150500.11.18.1
External linkshttp://www.suse.com/support/update/announcement/2024/suse-su-20240772-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU86924
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-0074
CWE-ID:
CWE-788 - Access of Memory Location After End of Buffer
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the NVIDIA GPU Display Driver for Linux. A local user can access a memory location after the end of the buffer and perform a denial of service (DoS) attack.
Update the affected package kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.5
Public Cloud Module: 15-SP5
Basesystem Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP5
SUSE Linux Enterprise Server 15: SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP5
SUSE Linux Enterprise Desktop 15: SP5
openSUSE Leap: 15.5
nvidia-open-driver-G06-signed-kmp-64kb: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-64kb-debuginfo: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-64kb-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-default: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-default-debuginfo: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-default-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-debugsource: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-azure-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-azure: before 550.54.14_k5.14.21_150500.33.34-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-azure-debuginfo: before 550.54.14_k5.14.21_150500.33.34-150500.3.36.1
kernel-firmware-nvidia-gspx-G06: before 550.54.14-150500.11.18.1
External linkshttp://www.suse.com/support/update/announcement/2024/suse-su-20240772-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU86926
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-0075
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
MitigationUpdate the affected package kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Micro: 5.5
Public Cloud Module: 15-SP5
Basesystem Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP5
SUSE Linux Enterprise Server 15: SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP5
SUSE Linux Enterprise Desktop 15: SP5
openSUSE Leap: 15.5
nvidia-open-driver-G06-signed-kmp-64kb: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-64kb-debuginfo: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-64kb-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-default: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-default-debuginfo: before 550.54.14_k5.14.21_150500.55.49-150500.3.36.1
nvidia-open-driver-G06-signed-default-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-debugsource: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-azure-devel: before 550.54.14-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-azure: before 550.54.14_k5.14.21_150500.33.34-150500.3.36.1
nvidia-open-driver-G06-signed-kmp-azure-debuginfo: before 550.54.14_k5.14.21_150500.33.34-150500.3.36.1
kernel-firmware-nvidia-gspx-G06: before 550.54.14-150500.11.18.1
External linkshttp://www.suse.com/support/update/announcement/2024/suse-su-20240772-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.