Information disclosure in nVidia products - CVE-2016-7386
Published: November 1, 2016
Vulnerability identifier: #VU1126
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2016-7386
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vendor: nVidia
Affected software:
NVS
Quadro
NVIDIA Windows GPU Display Driver
NVS
Quadro
NVIDIA Windows GPU Display Driver
Detailed vulnerability description
The vulnerability allows a local user to gain access to potentially sensitive information.
The weakness exists in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x70000D4, leading to kernel memory leak to user space through an uninitialized buffer.
Successful exploitation of the vulnerability results in disclosure of information.
The weakness exists in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x70000D4, leading to kernel memory leak to user space through an uninitialized buffer.
Successful exploitation of the vulnerability results in disclosure of information.
How to mitigate CVE-2016-7386
Update Quadro and NVS to 342.00, 375.63.
Update GeForce to 375.63.
Update GeForce to 375.63.