Vulnerability-Lookup

WID-SEC-W-2022-0894

Vulnerability from csaf_certbund - Published: 2022-08-02 22:00 - Updated: 2023-10-03 22:00

Summary

Nvidia GPU Treiber und NVIDIA vGPU software: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: NVidia ist ein Hersteller von Grafikkarten.

Angriff: Ein lokaler Angreifer kann mehrere Schwachstellen in Nvidia GPU Treiber ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuführen.

Betroffene Betriebssysteme: - Linux - Windows

CVE-2022-31606

Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgemäßen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuführen.

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31607

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31608

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31609

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31610

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31612

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31613

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31614

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31615

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31616

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31617

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-31618

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

CVE-2022-34665

Affected products

Known affected 7 products

Product	Identifier	Version
Dell Computer Dell	`cpe:/o:dell:dell_computer:-`	—
Lenovo Computer Lenovo	`cpe:/o:lenovo:lenovo_computer:-`	—
Ubuntu Linux Ubuntu	`cpe:/o:canonical:ubuntu_linux:-`	—
Gentoo Linux Gentoo	`cpe:/o:gentoo:linux:-`	—
Nvidia Treiber GPU Display Driver for Windows Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows`	—
Nvidia Treiber vGPU software Nvidia / Treiber	`cpe:/a:nvidia:display_driver:vgpu_software`	—
Nvidia Treiber GPU Display Driver for Linux Nvidia / Treiber	`cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux`	—

References

7 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://security.gentoo.org/glsa/202310-02	external
https://nvidia.custhelp.com/app/answers/detail/a_…	external
https://ubuntu.com/security/notices/USN-5547-1	external
https://support.lenovo.com/us/en/product_security…	external
https://www.dell.com/support/kbdoc/de-de/00020222…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "NVidia ist ein Hersteller von Grafikkarten.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in Nvidia GPU Treiber ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0894 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0894.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0894 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0894"
      },
      {
        "category": "external",
        "summary": "Gentoo Linux Security Advisory GLSA-202310-02 vom 2023-10-03",
        "url": "https://security.gentoo.org/glsa/202310-02"
      },
      {
        "category": "external",
        "summary": "Security Bulletin: NVIDIA GPU Display Driver - August 2022 vom 2022-08-02",
        "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5547-1 vom 2022-08-04",
        "url": "https://ubuntu.com/security/notices/USN-5547-1"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory LEN-91370 vom 2022-08-14",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-91370"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2022-222 vom 2022-09-20",
        "url": "https://www.dell.com/support/kbdoc/de-de/000202225/dsa-2022-222-dell-client-platform-security-update-for-nvidia-gpu-display-driver-vulnerabilities"
      }
    ],
    "source_lang": "en-US",
    "title": "Nvidia GPU Treiber und NVIDIA vGPU software: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-10-03T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:32:45.265+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2022-0894",
      "initial_release_date": "2022-08-02T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-08-02T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-08-03T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-08-14T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von LENOVO aufgenommen"
        },
        {
          "date": "2022-09-20T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2023-10-03T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Gentoo aufgenommen"
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Dell Computer",
            "product": {
              "name": "Dell Computer",
              "product_id": "T006498",
              "product_identification_helper": {
                "cpe": "cpe:/o:dell:dell_computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Dell"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Gentoo Linux",
            "product": {
              "name": "Gentoo Linux",
              "product_id": "T012167",
              "product_identification_helper": {
                "cpe": "cpe:/o:gentoo:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Gentoo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Lenovo Computer",
            "product": {
              "name": "Lenovo Computer",
              "product_id": "T006520",
              "product_identification_helper": {
                "cpe": "cpe:/o:lenovo:lenovo_computer:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Lenovo"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Nvidia Treiber GPU Display Driver for Windows",
                "product": {
                  "name": "Nvidia Treiber GPU Display Driver for Windows",
                  "product_id": "T024153",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:nvidia:display_driver:gpu_display_driver_for_windows"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Nvidia Treiber GPU Display Driver for Linux",
                "product": {
                  "name": "Nvidia Treiber GPU Display Driver for Linux",
                  "product_id": "T024154",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:nvidia:display_driver:gpu_display_driver_for_linux"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Nvidia Treiber vGPU software",
                "product": {
                  "name": "Nvidia Treiber vGPU software",
                  "product_id": "T024155",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:nvidia:display_driver:vgpu_software"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Treiber"
          }
        ],
        "category": "vendor",
        "name": "Nvidia"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-31606",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31606"
    },
    {
      "cve": "CVE-2022-31607",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31607"
    },
    {
      "cve": "CVE-2022-31608",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31608"
    },
    {
      "cve": "CVE-2022-31609",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31609"
    },
    {
      "cve": "CVE-2022-31610",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31610"
    },
    {
      "cve": "CVE-2022-31612",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31612"
    },
    {
      "cve": "CVE-2022-31613",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31613"
    },
    {
      "cve": "CVE-2022-31614",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31614"
    },
    {
      "cve": "CVE-2022-31615",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31615"
    },
    {
      "cve": "CVE-2022-31616",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31616"
    },
    {
      "cve": "CVE-2022-31617",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31617"
    },
    {
      "cve": "CVE-2022-31618",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-31618"
    },
    {
      "cve": "CVE-2022-34665",
      "notes": [
        {
          "category": "description",
          "text": "Im Nvidia GPU Treiber existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem aufgrund eines Out-of-Bounds-Zugriffs, einer unsachgem\u00e4\u00dfen Eingabevalidierung, eines Out-of-Bounds-Lese- und Schreibvorgangs und mehrerer NULL-Zeiger-Dereferenzen. Ein lokaler Angreifer kann diese Schwachstellen ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern, Daten zu manipulieren und beliebigen Code auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T006498",
          "T006520",
          "T000126",
          "T012167",
          "T024153",
          "T024155",
          "T024154"
        ]
      },
      "release_date": "2022-08-02T22:00:00.000+00:00",
      "title": "CVE-2022-34665"
    }
  ]
}

CVE-2022-31606 (GCVE-0-2022-31606)

Vulnerability from cvelistv5 – Published: 2022-11-18 00:00 – Updated: 2025-04-29 14:35

Summary

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a failure to properly validate data might allow an attacker with basic user capabilities to cause an out-of-bounds access in kernel mode, which could lead to denial of service, information disclosure, escalation of privileges, or data tampering.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

nvidia

References

1 reference

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…

Impacted products

1 product

Vendor	Product	Version
NVIDIA	NVIDIA Cloud Gaming (guest driver)	Affected: All versions prior to the August 2022 release

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:00.408Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31606",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T14:35:10.209384Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T14:35:23.192Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NVIDIA Cloud Gaming (guest driver)",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to the August 2022 release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a failure to properly validate data might allow an attacker with basic user capabilities to cause an out-of-bounds access in kernel mode, which could lead to denial of service, information disclosure, escalation of privileges, or data tampering."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-18T00:00:00.000Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31606",
    "datePublished": "2022-11-18T00:00:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-29T14:35:23.192Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31607 (GCVE-0-2022-31607)

Vulnerability from cvelistv5 – Published: 2022-11-18 00:00 – Updated: 2025-04-29 14:34

Summary

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilities can cause improper input validation, which may lead to denial of service, escalation of privileges, data tampering, and limited information disclosure.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation

Assigner

nvidia

References

2 references

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…
https://security.gentoo.org/glsa/202310-02	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
NVIDIA	NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager)	Affected: All versions prior to the August 2022 release

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:00.703Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          },
          {
            "name": "GLSA-202310-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202310-02"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31607",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T14:34:10.995607Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T14:34:43.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NVIDIA Cloud Gaming (guest driver), NVIDIA Cloud Gaming (Virtual GPU Manager)",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to the August 2022 release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilities can cause improper input validation, which may lead to denial of service, escalation of privileges, data tampering, and limited information disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T14:06:17.608Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        },
        {
          "name": "GLSA-202310-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202310-02"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31607",
    "datePublished": "2022-11-18T00:00:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-29T14:34:43.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31608 (GCVE-0-2022-31608)

Vulnerability from cvelistv5 – Published: 2022-11-18 00:00 – Updated: 2025-04-29 13:36

Summary

NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-281 - Improper Preservation of Permissions

Assigner

nvidia

References

2 references

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…
https://security.gentoo.org/glsa/202310-02	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
NVIDIA	GeForce, Workstation, Compute	Affected: All versions prior to the August 2022 release

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:00.902Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          },
          {
            "name": "GLSA-202310-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202310-02"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31608",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T13:36:05.444204Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T13:36:30.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GeForce, Workstation, Compute",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to the August 2022 release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-281",
              "description": "CWE-281 Improper Preservation of Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T14:06:26.816Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        },
        {
          "name": "GLSA-202310-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202310-02"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31608",
    "datePublished": "2022-11-18T00:00:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-29T13:36:30.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31609 (GCVE-0-2022-31609)

Vulnerability from cvelistv5 – Published: 2022-08-05 20:30 – Updated: 2024-08-03 07:26

Summary

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest is not authorized. This vulnerability may lead to loss of data integrity and confidentiality, denial of service, or information disclosure.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-285 - Improper Authorization

Assigner

nvidia

References

1 reference

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
NVIDIA	NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming	Affected: vGPU version 14.x (prior to 14.2), version 13.x (prior to 13.4) and version 11.x (prior 11.9).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.107Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "vGPU version 14.x (prior to 14.2), version 13.x (prior to 13.4) and version 11.x (prior 11.9)."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest is not authorized. This vulnerability may lead to loss of data integrity and confidentiality, denial of service, or information disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-05T20:30:19.000Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@nvidia.com",
          "ID": "CVE-2022-31609",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "vGPU version 14.x (prior to 14.2), version 13.x (prior to 13.4) and version 11.x (prior 11.9)."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NVIDIA"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest is not authorized. This vulnerability may lead to loss of data integrity and confidentiality, denial of service, or information disclosure."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 7.8,
            "baseSeverity": "High",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383",
              "refsource": "MISC",
              "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31609",
    "datePublished": "2022-08-05T20:30:19.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:26:01.107Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31610 (GCVE-0-2022-31610)

Vulnerability from cvelistv5 – Published: 2022-11-18 00:00 – Updated: 2025-04-29 14:33

Summary

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an out-of-bounds write, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

nvidia

References

1 reference

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…

Impacted products

1 product

Vendor	Product	Version
NVIDIA	NVIDIA Cloud Gaming (guest driver)	Affected: All versions prior to the August 2022 release

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:00.721Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31610",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T14:33:14.540090Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T14:33:34.082Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NVIDIA Cloud Gaming (guest driver)",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to the August 2022 release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an out-of-bounds write, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-18T00:00:00.000Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31610",
    "datePublished": "2022-11-18T00:00:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-29T14:33:34.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31612 (GCVE-0-2022-31612)

Vulnerability from cvelistv5 – Published: 2022-11-18 00:00 – Updated: 2025-04-29 14:30

Summary

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to a system crash or a leak of internal kernel information.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

nvidia

References

1 reference

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…

Impacted products

1 product

Vendor	Product	Version
NVIDIA	NVIDIA Cloud Gaming (guest driver)	Affected: All versions prior to the August 2022 release

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.182Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31612",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T14:30:36.416615Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T14:30:45.925Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NVIDIA Cloud Gaming (guest driver)",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to the August 2022 release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to a system crash or a leak of internal kernel information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-18T00:00:00.000Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31612",
    "datePublished": "2022-11-18T00:00:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-29T14:30:45.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31613 (GCVE-0-2022-31613)

Vulnerability from cvelistv5 – Published: 2022-11-18 00:00 – Updated: 2025-04-29 14:29

Summary

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where any local user can cause a null-pointer dereference, which may lead to a kernel panic.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

nvidia

References

1 reference

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…

Impacted products

1 product

Vendor	Product	Version
NVIDIA	NVIDIA Cloud Gaming (guest driver)	Affected: All versions prior to the August 2022 release

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.011Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31613",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T14:29:16.633314Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T14:29:39.165Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NVIDIA Cloud Gaming (guest driver)",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to the August 2022 release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where any local user can cause a null-pointer dereference, which may lead to a kernel panic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-18T00:00:00.000Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31613",
    "datePublished": "2022-11-18T00:00:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-29T14:29:39.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31614 (GCVE-0-2022-31614)

Vulnerability from cvelistv5 – Published: 2022-08-05 20:30 – Updated: 2024-08-03 07:26

Summary

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it may double-free some resources. An attacker may exploit this vulnerability with other vulnerabilities to cause denial of service, code execution, and information disclosure.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-415 - Double Free

Assigner

nvidia

References

1 reference

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
NVIDIA	NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming	Affected: vGPU version 14.x (prior to 14.2), version 13.x (prior to 13.4) and version 11.x (prior 11.9).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.102Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "vGPU version 14.x (prior to 14.2), version 13.x (prior to 13.4) and version 11.x (prior 11.9)."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it may double-free some resources. An attacker may exploit this vulnerability with other vulnerabilities to cause denial of service, code execution, and information disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415 Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-05T20:30:33.000Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@nvidia.com",
          "ID": "CVE-2022-31614",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "vGPU version 14.x (prior to 14.2), version 13.x (prior to 13.4) and version 11.x (prior 11.9)."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NVIDIA"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it may double-free some resources. An attacker may exploit this vulnerability with other vulnerabilities to cause denial of service, code execution, and information disclosure."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 7,
            "baseSeverity": "High",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-415 Double Free"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383",
              "refsource": "MISC",
              "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31614",
    "datePublished": "2022-08-05T20:30:33.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2024-08-03T07:26:01.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31615 (GCVE-0-2022-31615)

Vulnerability from cvelistv5 – Published: 2022-11-18 00:00 – Updated: 2025-04-29 14:28

Summary

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

nvidia

References

2 references

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…
https://security.gentoo.org/glsa/202310-02	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
NVIDIA	GeForce, Workstation, Compute	Affected: All versions prior to the August 2022 release

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.302Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          },
          {
            "name": "GLSA-202310-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202310-02"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31615",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T14:27:57.595382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T14:28:18.412Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GeForce, Workstation, Compute",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to the August 2022 release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-03T14:06:49.627Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        },
        {
          "name": "GLSA-202310-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202310-02"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31615",
    "datePublished": "2022-11-18T00:00:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-29T14:28:18.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31616 (GCVE-0-2022-31616)

Vulnerability from cvelistv5 – Published: 2022-11-18 00:00 – Updated: 2025-04-29 14:26

Summary

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

CWE

CWE-20 - Improper Input Validation

Assigner

nvidia

References

1 reference

URL	Tags
https://nvidia.custhelp.com/app/answers/detail/a_…

Impacted products

1 product

Vendor	Product	Version
NVIDIA	NVIDIA Cloud Gaming (guest driver)	Affected: All versions prior to the August 2022 release

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:00.838Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31616",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-29T14:26:17.038255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-29T14:26:33.240Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NVIDIA Cloud Gaming (guest driver)",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to the August 2022 release"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to denial of service, or information disclosure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-18T00:00:00.000Z",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2022-31616",
    "datePublished": "2022-11-18T00:00:00.000Z",
    "dateReserved": "2022-05-24T00:00:00.000Z",
    "dateUpdated": "2025-04-29T14:26:33.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2022-0894

CVE-2022-31606 (GCVE-0-2022-31606)

CVE-2022-31607 (GCVE-0-2022-31607)

CVE-2022-31608 (GCVE-0-2022-31608)

CVE-2022-31609 (GCVE-0-2022-31609)

CVE-2022-31610 (GCVE-0-2022-31610)

CVE-2022-31612 (GCVE-0-2022-31612)

CVE-2022-31613 (GCVE-0-2022-31613)

CVE-2022-31614 (GCVE-0-2022-31614)

CVE-2022-31615 (GCVE-0-2022-31615)

CVE-2022-31616 (GCVE-0-2022-31616)

Tags

Sightings

Nomenclature