Detections
Analytics
NVIDIA Linux GPU Display Driver 375.x < 375.66 / 381.x < 381.22 Multiple Vulnerabilities
high Nessus Plugin ID 100258
Language:
Synopsis
A display driver installed on the remote Linux host is affected by multiple vulnerabilities.Description
The version of the NVIDIA GPU display driver installed on the remote Linux host is 375.x prior to 375.66 or 381.x prior to 381.22. It is, therefore, affected by multiple vulnerabilities:- A flaw exists in the kernel mode layer handler due to improper validation of user-supplied input before it is used in offset calculations. A local attacker can exploit this to cause a denial of service condition or potentially to gain elevated privileges. (CVE-2017-0350)
- A NULL pointer dereference flaw exists in the kernel mode layer handler due to improper validation of user-supplied input. A local attacker can exploit this to cause a denial of service condition or potentially to gain elevated privileges. (CVE-2017-0351)
- A flaw exists in the GPU firmware due to incorrect access control that may allow CPU software to access sensitive GPU control registers. A local attacker can exploit this to gain elevated privileges.
(CVE-2017-0352)
Solution
Upgrade the NVIDIA graphics driver to version 375.66 / 381.22 or later in accordance with the vendor advisory.See Also
Plugin Details
Severity: High
ID: 100258
File Name: nvidia_unix_cve_2017_0355.nasl
Version: 1.8
Type: local
Agent: unix
Family: Misc.
Published: 5/17/2017
Updated: 3/15/2023
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2017-0352
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:nvidia:gpu_driver
Required KB Items: NVIDIA_UNIX_Driver/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 5/9/2017
Vulnerability Publication Date: 5/9/2017