Nvidia has published a new security bulletin detailing seven new vulnerabilities in its GPU display drivers and vGPU software. These range from medium to high severity, potentially opening attack vectors for data tampering and code execution. The bulletin covers GeForce RTX, Quadro, NVS, Tesla, vGPU, and Cloud Gaming software, on Windows and Linux.
Problems can arise with the kernel-mode driver, driver resource handling, improper GPU resource access, a time-of-check/time-of-use issue, and a driver-lock leak. Depending on the Nvidia software branch, different combinations of these vulnerabilities can be present.
Successful exploitation of these vulnerabilities, of which nine out of 15 are marked as high severity, could lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution. Specifically, on Windows, the company alerts about a kernel-mode layer vulnerability in its display driver, where a user could cause improper access to GPU resources. On Linux, the display driver is vulnerable to attacks that could cause a use-after-free. As for the vGPU software, the virtual GPU manager is sensitive to attacks that leverage a use-after-free for stack memory.
- Use-after-free bugs are memory errors that can lead to crashes or exploitation.
- Improper access to GPU resources means unauthorised code might get more access than intended.
- Out-of-bounds reads or writes allow writing outside allocated memory, which could allow attackers to corrupt data.
Due to the risks involved, users are advised to download and install said updates from the official download page or via the built-in update section on the GeForce drivers. Speaking of which, gamers who keep their GPUs up to date won’t need to do anything, as the latest GeForce Game Ready Driver 596.49, released on May 12, already contains these fixes. If your system is running software version prior to 596.36, or 582.53 for Maxwell, Volta, and Pascal GPUs, you will need to update your drivers.
