NVIDIA Graphics Driver 340.x < 341.95 / 352.x < 354.74 Multiple Vulnerabilities

high Nessus Plugin ID 90119

Language:

Synopsis

The remote Windows host is affected by multiple vulnerabilities.

Description

The version of the NVIDIA graphics driver installed on the remote Windows host is 340.x prior to 341.95 or 352.x prior to 354.74. It is, therefore, affected by multiple vulnerabilities :

- A privilege escalation vulnerability exists due to a kernel driver escape. A local attacker can exploit this to gain unauthorized access to restricted functionality, potentially allowing the execution of arbitrary code.
(CVE-2016-2556)

- An information disclosure vulnerability exists due to an out-of-bounds read error. A local attacker can exploit this to read arbitrary information from memory.
(CVE-2016-2557)

- An unspecified untrusted pointer flaw exists that allows a local attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-2558)

Solution

Upgrade to video driver version 341.95 / 354.74 or later.

Plugin Details

Severity: High

ID: 90119

File Name: nvidia_win_cve_2016_2556.nasl

Version: 1.9

Type: local

Agent: windows

Family: Windows

Published: 3/23/2016

Updated: 4/5/2023

Configuration: Enable paranoid mode

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2016-2558

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 7.3

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:nvidia:gpu_driver

Required KB Items: Settings/ParanoidReport, WMI/DisplayDrivers/NVIDIA

Exploit Ease: No known exploits are available

Patch Publication Date: 3/16/2016

Vulnerability Publication Date: 3/14/2016

Reference Information

CVE: CVE-2016-2556, CVE-2016-2557, CVE-2016-2558

Detections

Analytics