NULL pointer dereference in NVIDIA Windows GPU Display Driver - CVE-2023-31022

Vulnerability identifier: #VU82616

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-31022

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the kernel mode layer in GPU Display Driver. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.

NVIDIA Windows GPU Display Driver
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Public Cloud Module
Basesystem Module
openSUSE Leap
NVIDIA Linux GPU Display Driver
nvidia-open-driver-G06-signed-kmp-azure-debuginfo
nvidia-open-driver-G06-signed-kmp-azure
nvidia-open-driver-G06-signed-kmp-64kb-debuginfo
nvidia-open-driver-G06-signed-kmp-64kb
nvidia-open-driver-G06-signed-kmp-default
nvidia-open-driver-G06-signed-kmp-default-debuginfo
kernel-firmware-nvidia-gspx-G06
nvidia-open-driver-G06-signed-azure-devel
nvidia-open-driver-G06-signed-debugsource
nvidia-open-driver-G06-signed-default-devel
nvidia-open-driver-G06-signed-64kb-devel

Install updates from vendor's website.

NVIDIA Windows GPU Display Driver - addressed in versions 474.64, 529.19, 537.70
NVIDIA Linux GPU Display Driver - addressed in versions 470.223.02, 525.147.05, 535.109.03
nvidia-open-driver-G06-signed-kmp-azure-debuginfo - addressed in versions 535.129.03_k5.14.21_150400.14.72-150400.9.27.1, 535.129.03_k5.14.21_150500.33.20-150500.3.13.1
nvidia-open-driver-G06-signed-kmp-azure - addressed in versions 535.129.03_k5.14.21_150400.14.72-150400.9.27.1, 535.129.03_k5.14.21_150500.33.20-150500.3.13.1
nvidia-open-driver-G06-signed-kmp-64kb-debuginfo - addressed in versions 535.129.03_k5.14.21_150400.24.92-150400.9.27.1, 535.129.03_k5.14.21_150500.55.31-150500.3.13.1
nvidia-open-driver-G06-signed-kmp-64kb - addressed in versions 535.129.03_k5.14.21_150400.24.92-150400.9.27.1, 535.129.03_k5.14.21_150500.55.31-150500.3.13.1
nvidia-open-driver-G06-signed-kmp-default - addressed in versions 535.129.03_k5.14.21_150400.24.92-150400.9.27.1, 535.129.03_k5.14.21_150500.55.31-150500.3.13.1
nvidia-open-driver-G06-signed-kmp-default-debuginfo - addressed in versions 535.129.03_k5.14.21_150400.24.92-150400.9.27.1, 535.129.03_k5.14.21_150500.55.31-150500.3.13.1
kernel-firmware-nvidia-gspx-G06 - addressed in versions 535.129.03-150400.9.12.1, 535.129.03-150500.11.9.1
nvidia-open-driver-G06-signed-azure-devel - addressed in versions 535.129.03-150400.9.27.1, 535.129.03-150500.3.13.1
nvidia-open-driver-G06-signed-debugsource - addressed in versions 535.129.03-150400.9.27.1, 535.129.03-150500.3.13.1
nvidia-open-driver-G06-signed-default-devel - addressed in versions 535.129.03-150400.9.27.1, 535.129.03-150500.3.13.1
nvidia-open-driver-G06-signed-64kb-devel - addressed in versions 535.129.03-150400.9.27.1, 535.129.03-150500.3.13.1

• https://nvidia.custhelp.com/app/answers/detail/a_id/5491

• Multiple vulnerabilities in NVIDIA Windows GPU Display Driver
• Multiple vulnerabilities in NVIDIA Linux GPU Display Driver
• SUSE update for kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed
• SUSE update for kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed
• Gentoo update for NVIDIA Drivers