NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause an integer overflow, which may lead to information disclosure and denial of service.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an     unprivileged user can cause an integer overflow, which may lead to information disclosure and denial of     service. (CVE-2023-25516)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202405-28 (NVIDIA Drivers: Multiple Vulnerabilities)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where unexpected untrusted data     is parsed, which may lead to code execution, denial of service, escalation of privileges, data tampering,     or information disclosure. (CVE-2023-25515)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an     unprivileged user can cause an integer overflow, which may lead to information disclosure and denial of     service. (CVE-2023-25516)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a     NULL-pointer dereference may lead to denial of service. (CVE-2023-31022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by the following vulnerabilities:

  - NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU,     which may allow an attacker with physical access to the target device to read and write to arbitrary     memory. A successful exploit of this vulnerability may lead to code execution, denial of service,     information disclosure, and loss of integrity. (CVE-2023-25515)

  - An integer overflow vulnerability in the kernel mode layer that can result in information disclosure or     denial of service. (CVE-2023-25516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
247784	Linux Distros Unpatched Vulnerability : CVE-2023-25516	Nessus	Misc.	high
195168	GLSA-202405-28 : NVIDIA Drivers: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
177833	NVIDIA Linux GPU Display Driver (Jun 2023)	Nessus	Misc.	high

Detections

Analytics

CVE-2023-25516

high

Tenable Plugins

high

high

high