NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an     untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might     lead to denial of service, information disclosure, and data tampering. (CVE-2024-0091)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2585-1 advisory.

    Update to version 555.42.06 for CUDA.

    Security Update 550.90.07:

    - CVE-2024-0090: Fixed out of bounds write (bsc#1223356).
    - CVE-2024-0092: Fixed incorrect exception handling (bsc#1223356).
    - CVE-2024-0091: Fixed untrusted pointer dereference (bsc#1223356).

    Changes in kernel-firmware-nvidia-gspx-G06:

    - Update to 550.100 (bsc#1227575)

    - Add a second flavor to be used by the kernel module versions       used by CUDA. The firmware targetting CUDA contains '-cuda' in       its name to track its versions separately from the graphics       firmware. (bsc#1227417)

    Changes in nvidia-open-driver-G06-signed:

    - Update to 550.100 (bsc#1227575)

      * Fixed a bug that caused OpenGL triple buffering to behave like         double buffering.

    - To avoid issues with missing dependencies when no CUDA repo       is present make the dependecy to nvidia-compute-G06 conditional.

    - CUDA is not available for Tumbleweed, exclude the build of the       cuda flavor.

    - preamble: let the -cuda flavor KMP require the -cuda flavor       firmware

    - Add a second flavor for building the kernel module versions       used by CUDA. The kmp targetting CUDA contains '-cuda' in       its name to track its versions separately from the graphics       kmp. (bsc#1227417)
    - Provide the meta package nv-prefer-signed-open-driver to       make sure the latest available SUSE-build open driver is       installed - independent of the latest available open driver       version in he CUDA repository.
      Rationale:
      The package cuda-runtime provides the link between CUDA and       the kernel driver version through a       Requires: cuda-drivers >= %version       This implies that a CUDA version will run withany kernel driver       version equal or higher than a base version.
      nvidia-compute-G06 provides the glue layer between CUDA and       a specific version of he kernel driver both by providing       a set of base libraries and by requiring a specific kernel       version. 'cuda-drivers' (provided by nvidia-compute-utils-G06)       requires an unversioned nvidia-compute-G06. With this, the       resolver will install the latest available and applicable       nvidia-compute-G06.
      nv-prefer-signed-open-driver then represents the latest available       open driver version and restricts the nvidia-compute-G06 version       to it. (bsc#1227419)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  -	NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds   write. A successful exploit of this vulnerability might lead to code execution, denial of service,   escalation of privileges, information disclosure, and data tampering.(CVE-2024-0090)

  -	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an   untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might   lead to denial of service, information disclosure, and data tampering. (CVE-2024-0091)

  - NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where the guest OS   could cause buffer overrun in the host. A successful exploit of this vulnerability might lead to   information disclosure, data tampering, escalation of privileges, and denial of service. (CVE-2024-0099) 	Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  -	NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds   write. A successful exploit of this vulnerability might lead to code execution, denial of service,   escalation of privileges, information disclosure, and data tampering.(CVE-2024-0090)

  -	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an   untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might   lead to denial of service, information disclosure, and data tampering. (CVE-2024-0091)

  - NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper   handling of exception conditions might lead to denial of service. (CVE-2024-0092)

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

A display driver installed on the remote Windows host is affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Display Driver for Windows contains a vulnerability where the information from a previous     client or another process could be disclosed. A successful exploit of this vulnerability might lead to     code execution, information disclosure, or data tampering. (CVE-2024-0089)

  -	NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds     write. A successful exploit of this vulnerability might lead to code execution, denial of service,     escalation of privileges, information disclosure, and data tampering.(CVE-2024-0090)

  -	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an     untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might     lead to denial of service, information disclosure, and data tampering. (CVE-2024-0091)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the driver's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2005-1 advisory.

    Security Update 550.90.07:

    - CVE-2024-0090: Fixed out of bounds write (bsc#1223356).
    - CVE-2024-0092: Fixed incorrect exception handling (bsc#1223356).
    - CVE-2024-0091: Fixed untrusted pointer dereference (bsc#1223356).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1990-1 advisory.

    Security Update 550.90.07:

    - CVE-2024-0090: Fixed out of bounds write (bsc#1223356).
    - CVE-2024-0092: Fixed incorrect exception handling (bsc#1223356).
    - CVE-2024-0091: Fixed untrusted pointer dereference (bsc#1223356).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
248876	Linux Distros Unpatched Vulnerability : CVE-2024-0091	Nessus	Misc.	Local	high
203004	SUSE SLED15: kernel-firmware-nvidia-gspx-G06 / etc (SUSE-SU-2024:2585-1)	Nessus	SuSE Local Security Checks	Local	high
200467	NVIDIA Virtual GPU Manager Multiple Vulnerabilities (June 2024)	Nessus	Misc.	Local	high
200466	NVIDIA Linux GPU Display Driver (June 2024)	Nessus	Misc.	Local	high
200465	NVIDIA Windows GPU Display Driver (June 2024)	Nessus	Windows	Local	high
200459	SUSE SLES15: kernel-firmware-nvidia-gspx-G06 / etc (SUSE-SU-2024:2005-1)	Nessus	SuSE Local Security Checks	Local	high
200402	SUSE SLED15: kernel-firmware-nvidia-gspx-G06 / etc (SUSE-SU-2024:1990-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2024-0091

high

Tenable Plugins

high

high

high

high

high

high

high