NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer dereference by accessing passed parameters the validity of which has not been checked. A successful exploit of this vulnerability may lead to denial of service and limited information disclosure.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-     pointer dereference by accessing passed parameters the validity of which has not been checked. A     successful exploit of this vulnerability may lead to denial of service and limited information disclosure.
    (CVE-2024-0075)

Note that Nessus relies on the presence of the package as reported by the vendor.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - NVIDIA GPU Display Driver for WIndows and Linux contains a vulnerability in the kernel mode data handler, where an     unprivileged regular user can cause integer overflow, which may lead to denial of service, information disclosure,     and data tampering. (CVE-2022-42665)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after     the end of the buffer. A successful exploit of this vulnerability may lead to denial of service and data tampering.     (CVE-2024-0074)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer     dereference by accessing passed parameters the validity of which has not been checked. A successful exploit of     this vulnerability may lead to denial of service and limited information disclosure. (CVE-2024-0075)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in     a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service. (CVE-2024-0078)

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Display Driver for WIndows and Linux contains a vulnerability in the kernel mode data handler, where an     unprivileged regular user can cause integer overflow, which may lead to denial of service, information disclosure,     and data tampering. (CVE-2022-42665)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after     the end of the buffer. A successful exploit of this vulnerability may lead to denial of service and data tampering.     (CVE-2024-0074)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer     dereference by accessing passed parameters the validity of which has not been checked. A successful exploit of     this vulnerability may lead to denial of service and limited information disclosure. (CVE-2024-0075)

  - NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, where it allows a guest OS to allocate     resources for which the guest OS is not authorized. A successful exploit of this vulnerability may lead to code     execution, denial of service, escalation of privileges, information disclosure, and data tampering. (CVE-2024-0077)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in     a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service. (CVE-2024-0078)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user     in a guest VM can cause a NULL-pointer dereference in the host. A successful exploit of this vulnerability may     lead to denial of service. (CVE-2024-0079) 	Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A display driver installed on the remote Windows host is affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an     unprivileged regular user can cause an out-of-bounds write. A successful exploit of this vulnerability may     lead to code execution, denial of service, escalation of privileges, information disclosure, and data     tampering. (CVE-2024-0071)

  -	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer when the driver is     performing an operation at a privilege level that is higher than the minimum level required. A successful     exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges,     information disclosure, and data tampering. (CVE-2024-0073)

  -	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a     user in a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service.
    (CVE-2024-0078)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the driver's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0770-1 advisory.

    Update to 550.54.14

    * Added vGPU Host and vGPU Guest support. For vGPU Host, please       refer to the README.vgpu packaged in the vGPU Host Package for       more details.

    Security issues fixed:

    * CVE-2024-0074: A user could trigger a NULL ptr dereference.
    * CVE-2024-0075: A user could overwrite the end of a buffer, leading to crashes or code execution.
    * CVE-2022-42265: A unprivileged user could trigger an integer overflow which could lead to crashes or     code execution.


    - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks       also during modprobing the nvidia module; this changes the issue       of not having access to /dev/nvidia${devid}, when gfxcard has       been replaced by a different gfx card after installing the driver

    - provide nvidia-open-driver-G06-kmp (jsc#PED-7117)
      * this makes it easy to replace the package from nVidia's         CUDA repository with this presigned package

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0772-1 advisory.

    Update to 550.54.14:

    * Added vGPU Host and vGPU Guest support. For vGPU Host, please       refer to the README.vgpu packaged in the vGPU Host Package for       more details.
    Security issues fixed:

    * CVE-2024-0074: A user could trigger a NULL ptr dereference.
    * CVE-2024-0075: A user could overwrite the end of a buffer, leading to crashes or code execution.
    * CVE-2022-42265: A unprivileged user could trigger an integer overflow which could lead to crashes or     code execution.


    - create /run/udev/static_node-tags/uaccess/nvidia${devid} symlinks       also during modprobing the nvidia module; this changes the issue       of not having access to /dev/nvidia${devid}, when gfxcard has       been replaced by a different gfx card after installing the driver
    - provide nvidia-open-driver-G06-kmp (jsc#PED-7117)

      This makes it easy to replace the package from nVidia's       CUDA repository with this presigned package

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
249385	Linux Distros Unpatched Vulnerability : CVE-2024-0075	Nessus	Misc.	medium
191744	NVIDIA Linux GPU Display Driver (February 2024)	Nessus	Misc.	high
191743	NVIDIA Virtual GPU Manager Multiple Vulnerabilities (February 2024)	Nessus	Misc.	high
191676	NVIDIA Windows GPU Display Driver (February 2024)	Nessus	Windows	high
191642	SUSE SLES15: kernel-firmware-nvidia-gspx-G06 / etc (SUSE-SU-2024:0770-1)	Nessus	SuSE Local Security Checks	high
191624	SUSE SLED15: kernel-firmware-nvidia-gspx-G06 / etc (SUSE-SU-2024:0772-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-0075

medium

Tenable Plugins

medium

high

high

high

high

high