Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU86927
Risk: Low
CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-42265
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to integer overflow within the NVIDIA GPU Display Driver in the kernel mode layer (nvidia.ko). A local user can trigger an integer overflow and perform a denial of service (DoS) attack or gain access to sensitive information.
Update the affected package kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP4 LTSS: 15-SP4
SUSE Linux Enterprise High Performance Computing LTSS 15: SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
SUSE Linux Enterprise Desktop 15 SP4 LTSS: 15-SP4
SUSE Linux Enterprise Micro for Rancher: 5.3 - 5.4
SUSE Linux Enterprise Micro: 5.3 - 5.4
SUSE Linux Enterprise Server for SAP Applications 15: SP4
SUSE Linux Enterprise Server 15: SP4
SUSE Linux Enterprise High Performance Computing 15: SP4
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
openSUSE Leap: 15.4
nvidia-open-driver-G06-signed-azure-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-azure: before 550.54.14_k5.14.21_150400.14.75-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-azure-debuginfo: before 550.54.14_k5.14.21_150400.14.75-150400.9.50.1
nvidia-open-driver-G06-signed-default-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-64kb: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-64kb-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-64kb-debuginfo: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-default-debuginfo: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-debugsource: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-default: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
kernel-firmware-nvidia-gspx-G06: before 550.54.14-150400.9.21.1
External linkshttp://www.suse.com/support/update/announcement/2024/suse-su-20240770-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU86924
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-0074
CWE-ID:
CWE-788 - Access of Memory Location After End of Buffer
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error in the NVIDIA GPU Display Driver for Linux. A local user can access a memory location after the end of the buffer and perform a denial of service (DoS) attack.
Update the affected package kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP4 LTSS: 15-SP4
SUSE Linux Enterprise High Performance Computing LTSS 15: SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
SUSE Linux Enterprise Desktop 15 SP4 LTSS: 15-SP4
SUSE Linux Enterprise Micro for Rancher: 5.3 - 5.4
SUSE Linux Enterprise Micro: 5.3 - 5.4
SUSE Linux Enterprise Server for SAP Applications 15: SP4
SUSE Linux Enterprise Server 15: SP4
SUSE Linux Enterprise High Performance Computing 15: SP4
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
openSUSE Leap: 15.4
nvidia-open-driver-G06-signed-azure-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-azure: before 550.54.14_k5.14.21_150400.14.75-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-azure-debuginfo: before 550.54.14_k5.14.21_150400.14.75-150400.9.50.1
nvidia-open-driver-G06-signed-default-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-64kb: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-64kb-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-64kb-debuginfo: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-default-debuginfo: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-debugsource: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-default: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
kernel-firmware-nvidia-gspx-G06: before 550.54.14-150400.9.21.1
External linkshttp://www.suse.com/support/update/announcement/2024/suse-su-20240770-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU86926
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-0075
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.
MitigationUpdate the affected package kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server 15 SP4 LTSS: 15-SP4
SUSE Linux Enterprise High Performance Computing LTSS 15: SP4
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4
SUSE Linux Enterprise Desktop 15 SP4 LTSS: 15-SP4
SUSE Linux Enterprise Micro for Rancher: 5.3 - 5.4
SUSE Linux Enterprise Micro: 5.3 - 5.4
SUSE Linux Enterprise Server for SAP Applications 15: SP4
SUSE Linux Enterprise Server 15: SP4
SUSE Linux Enterprise High Performance Computing 15: SP4
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
openSUSE Leap: 15.4
nvidia-open-driver-G06-signed-azure-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-azure: before 550.54.14_k5.14.21_150400.14.75-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-azure-debuginfo: before 550.54.14_k5.14.21_150400.14.75-150400.9.50.1
nvidia-open-driver-G06-signed-default-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-64kb: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-64kb-devel: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-64kb-debuginfo: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-default-debuginfo: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
nvidia-open-driver-G06-signed-debugsource: before 550.54.14-150400.9.50.1
nvidia-open-driver-G06-signed-kmp-default: before 550.54.14_k5.14.21_150400.24.108-150400.9.50.1
kernel-firmware-nvidia-gspx-G06: before 550.54.14-150400.9.21.1
External linkshttp://www.suse.com/support/update/announcement/2024/suse-su-20240770-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.