https://nvidia.custhelp.com/app/answers/detail/a_id/5353

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an     unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which     may lead to code execution, denial of service, escalation of privileges, information disclosure, and data     tampering. The scope of the impact may extend to other components. (CVE-2022-28181)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged     regular user can cause an out-of-bounds read, which may lead to denial of service and information disclosure.
    (CVE-2022-28183)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler     for DxgkDdiEscape, where an unprivileged regular user can access administrator-privileged registers, which may lead     to denial of service, information disclosure, and data tampering. (CVE-2022-28184)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the ECC layer, where an unprivileged regular user     can cause an out-of-bounds write, which may lead to denial of service and data tampering. (CVE-2022-28185)

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

A display driver installed on the remote Windows host is affected by a vulnerability:

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged     regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead     to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The     scope of the impact may extend to other components. (CVE-2022-28181)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the DirectX11 user mode driver (nvwgf2um/x.dll),     where an unauthorized attacker on the network can cause an out-of-bounds write through a specially crafted shader,     which may lead to code execution to cause denial of service, escalation of privileges, information disclosure, and     data tampering. The scope of the impact may extend to other components. (CVE-2022-28182)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged     regular user can cause an out-of-bounds read, which may lead to denial of service and information disclosure.
    (CVE-2022-28183)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for     DxgkDdiEscape, where an unprivileged regular user can access administrator-privileged registers, which may lead to     denial of service, information disclosure, and data tampering. (CVE-2022-28184)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the ECC layer, where an unprivileged regular user     can cause an out-of-bounds write, which may lead to denial of service and data tampering. (CVE-2022-28185)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for     DxgkDdiEscape, where the product receives input or data, but does not validate or incorrectly validates that the     input has the properties that are required to process the data safely and correctly, which may lead to denial of     service or data tampering. (CVE-2022-28186)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the     memory management software does not release a resource after its effective lifetime has ended, which may lead to     denial of service. (CVE-2022-28187)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for     DxgkDdiEscape, where the product receives input or data, but does not validate or incorrectly validates that the     input has the properties that are required to process the data safely and correctly, which may lead to denial of     service. (CVE-2022-28188)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for     DxgkDdiEscape, where a NULL pointer dereference may lead to a system crash. (CVE-2022-28189)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for     DxgkDdiEscape, where improper input validation can cause denial of service. (CVE-2022-28190)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the driver's self-reported version number.

ID	Name	Product	Family	Severity
163400	NVIDIA Linux GPU Display Driver (May 2022)	Nessus	Misc.	high
163399	NVIDIA Windows GPU Display Driver (May 2022)	Nessus	Windows	high

CVE-2022-28181

high

Tenable Plugins

high

high