NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after the end of the buffer. A successful exploit of this vulnerability may lead to denial of service and data tampering.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory     location after the end of the buffer. A successful exploit of this vulnerability may lead to denial of     service and data tampering. (CVE-2024-0074)

Note that Nessus relies on the presence of the package as reported by the vendor.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - NVIDIA GPU Display Driver for WIndows and Linux contains a vulnerability in the kernel mode data handler, where an     unprivileged regular user can cause integer overflow, which may lead to denial of service, information disclosure,     and data tampering. (CVE-2022-42665)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after     the end of the buffer. A successful exploit of this vulnerability may lead to denial of service and data tampering.     (CVE-2024-0074)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer     dereference by accessing passed parameters the validity of which has not been checked. A successful exploit of     this vulnerability may lead to denial of service and limited information disclosure. (CVE-2024-0075)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in     a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service. (CVE-2024-0078)

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Display Driver for WIndows and Linux contains a vulnerability in the kernel mode data handler, where an     unprivileged regular user can cause integer overflow, which may lead to denial of service, information disclosure,     and data tampering. (CVE-2022-42665)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after     the end of the buffer. A successful exploit of this vulnerability may lead to denial of service and data tampering.     (CVE-2024-0074)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer     dereference by accessing passed parameters the validity of which has not been checked. A successful exploit of     this vulnerability may lead to denial of service and limited information disclosure. (CVE-2024-0075)

  - NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, where it allows a guest OS to allocate     resources for which the guest OS is not authorized. A successful exploit of this vulnerability may lead to code     execution, denial of service, escalation of privileges, information disclosure, and data tampering. (CVE-2024-0077)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in     a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service. (CVE-2024-0078)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user     in a guest VM can cause a NULL-pointer dereference in the host. A successful exploit of this vulnerability may     lead to denial of service. (CVE-2024-0079) 	Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0770-1 advisory.

    Update to 550.54.14

    * Added vGPU Host and vGPU Guest support. For vGPU Host, please       refer to the README.vgpu packaged in the vGPU Host Package for       more details.

    Security issues fixed:

    * CVE-2024-0074: A user could trigger a NULL ptr dereference.
    * CVE-2024-0075: A user could overwrite the end of a buffer, leading to crashes or code execution.
    * CVE-2022-42265: A unprivileged user could trigger an integer overflow which could lead to crashes or     code execution.


    - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks       also during modprobing the nvidia module; this changes the issue       of not having access to /dev/nvidia${devid}, when gfxcard has       been replaced by a different gfx card after installing the driver

    - provide nvidia-open-driver-G06-kmp (jsc#PED-7117)
      * this makes it easy to replace the package from nVidia's         CUDA repository with this presigned package

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0772-1 advisory.

    Update to 550.54.14:

    * Added vGPU Host and vGPU Guest support. For vGPU Host, please       refer to the README.vgpu packaged in the vGPU Host Package for       more details.
    Security issues fixed:

    * CVE-2024-0074: A user could trigger a NULL ptr dereference.
    * CVE-2024-0075: A user could overwrite the end of a buffer, leading to crashes or code execution.
    * CVE-2022-42265: A unprivileged user could trigger an integer overflow which could lead to crashes or     code execution.


    - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks       also during modprobing the nvidia module; this changes the issue       of not having access to /dev/nvidia${devid}, when gfxcard has       been replaced by a different gfx card after installing the driver
    - provide nvidia-open-driver-G06-kmp (jsc#PED-7117)

      This makes it easy to replace the package from nVidia's       CUDA repository with this presigned package

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
247321	Linux Distros Unpatched Vulnerability : CVE-2024-0074	Nessus	Misc.	high
191744	NVIDIA Linux GPU Display Driver (February 2024)	Nessus	Misc.	high
191743	NVIDIA Virtual GPU Manager Multiple Vulnerabilities (February 2024)	Nessus	Misc.	high
191642	SUSE SLES15: kernel-firmware-nvidia-gspx-G06 / etc (SUSE-SU-2024:0770-1)	Nessus	SuSE Local Security Checks	high
191624	SUSE SLED15: kernel-firmware-nvidia-gspx-G06 / etc (SUSE-SU-2024:0772-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-0074

high

Tenable Plugins

high

high

high

high

high