#VU1126 Information disclosure in nVidia products - CVE-2016-7386
Published: November 1, 2016
Vulnerability identifier: #VU1126
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2016-7386
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerable software:
NVS
Quadro
NVIDIA Windows GPU Display Driver
NVS
Quadro
NVIDIA Windows GPU Display Driver
Software vendor:
nVidia
nVidia
Description
The vulnerability allows a local user to gain access to potentially sensitive information.
The weakness exists in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x70000D4, leading to kernel memory leak to user space through an uninitialized buffer.
Successful exploitation of the vulnerability results in disclosure of information.
The weakness exists in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x70000D4, leading to kernel memory leak to user space through an uninitialized buffer.
Successful exploitation of the vulnerability results in disclosure of information.
Remediation
Update Quadro and NVS to 342.00, 375.63.
Update GeForce to 375.63.
Update GeForce to 375.63.