NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposed by the GPU performance counters. Local user access is required. This is not a network or remote attack vector.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the     GPU through a side channel exposed by the GPU performance counters. Local user access is required. This is     not a network or remote attack vector. (CVE-2018-6260)

Note that Nessus relies on the presence of the package as reported by the vendor.

NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposed by the GPU performance counters. Local user access is required. This is not a network or remote attack vector.
(CVE-2018-6260)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3904-1 advisory.

    It was discovered that the NVIDIA graphics drivers incorrectly handled the GPU performance counters. A     local attacker could possibly use this issue to access the application data processed on the GPU.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability in the 3D vision component in which the stereo     service software, when opening a file, does not check for hard     links. This behavior may lead to code execution, denial of     service or escalation of privileges. (CVE-2019-5665)

  - A vulnerability in the kernel mode layer (nvlddmkm.sys) create     context command DDI DxgkDdiCreateContext in which the product     uses untrusted input when calculating or using an array index,     but the product does not validate or incorrectly validates the     index to ensure the index references a valid position within the     array, which may lead to denial of service or escalation of     privileges. (CVE-2019-5666)

  - A vulnerability in the kernel mode layer (nvlddmkm.sys) handler     for DxgkDdiSetRootPageTable in which the application dereferences     a pointer that it expects to be valid, but is NULL, which may     lead to code execution, denial of service or escalation of     privileges. (CVE-2019-5667)

It is also affected by additional vulnerabilities including denial of service, privilege escalation, code execution, and information disclosure vulnerabilities. See the vendor advisory for details.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by a local information disclosure vulnerability.

ID	Name	Product	Family	Type	Severity
246787	Linux Distros Unpatched Vulnerability : CVE-2018-6260	Nessus	Misc.	Local	medium
123090	Amazon Linux AMI : nvidia (ALAS-2019-1182)	Nessus	Amazon Linux Local Security Checks	Local	medium
122716	Ubuntu 18.04 LTS : NVIDIA graphics drivers vulnerability (USN-3904-1)	Nessus	Ubuntu Local Security Checks	Local	medium
122510	NVIDIA Windows GPU Display Driver Multiple Vulnerabilities (February 2019)	Nessus	Windows	Local	high
122509	NVIDIA Linux GPU Display Driver Information Disclosure Vulnerability (CVE-2018-6260)	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2018-6260

medium

Tenable Plugins

medium

medium

medium

high

medium