NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service, information disclosure, or data corruption.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2888 advisory.

    Multiple security vulnerabilities have been discovered in the NVIDIA binary driver and libraries that     provide optimized hardware acceleration which may lead to denial of service, information disclosure or     data corruption. For Debian 9 stretch, these problems have been fixed in version 390.144-1~deb9u1. We     recommend that you upgrade your nvidia-graphics-drivers packages. For the detailed security status of     nvidia-graphics-drivers please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/nvidia-graphics-drivers Further information about Debian LTS security     advisories, how to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4935-1 advisory.

    It was discovered that the NVIDIA GPU display driver for the Linux kernel incorrectly performed access     control. A local attacker could use this issue to cause a denial of service, expose sensitive information,     or escalate privileges. (CVE-2021-1076)

    It was discovered that the NVIDIA GPU display driver for the Linux kernel incorrectly performed reference     counting. A local attacker could use this issue to cause a denial of service. (CVE-2021-1077)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode     layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service, information     disclosure, or data corruption (CVE-2021-1076).

  - NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability     where the software uses a reference count to manage a resource that is incorrectly updated, which may lead     to denial of service (CVE-2021-1077).

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

A display driver installed on the remote Windows host is affected by multiple vulnerabilities:
    
    - NVIDIA Windows GPU Display Driver for Windows, R390 driver branch, contains a vulnerability       in its installer where an attacker with local system access may replace an application resource       with malicious files. Such an attack may lead to code execution, escalation of privileges, denial       of service, or information disclosure (CVE-2021-1074).

    - NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel       mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the program dereferences a pointer that       contains a location for memory that is no longer valid, which may lead to code execution, denial of       service, or escalation of privileges (CVE-2021-1075).

    - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel       mode layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service,       information disclosure, or data corruption (CVE-2021-1076).
    Note that Nessus has not attempted to exploit these issues but has instead relied only on the driver's   self-reported version number.

The version of nvidia installed on the remote host is prior to 418.197.02-2018.03.117. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1495 advisory.

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer     (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service, information     disclosure, or data corruption. (CVE-2021-1076)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
156794	Debian DLA-2888-1 : nvidia-graphics-drivers - LTS security update	Nessus	Debian Local Security Checks	high
149306	Ubuntu 18.04 LTS / 20.04 LTS : NVIDIA graphics drivers vulnerabilities (USN-4935-1)	Nessus	Ubuntu Local Security Checks	high
149046	NVIDIA Linux GPU Display (April 2021)	Nessus	Misc.	high
149045	NVIDIA Windows GPU Display Driver (April 2021)	Nessus	Windows	high
148898	Amazon Linux AMI : nvidia (ALAS-2021-1495)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2021-1076

high

Tenable Plugins

high

high

high

high

high