NVIDIA Patches High-Severity GeForce Spoof-Attack Bug

NVIDIA gaming graphics software package referred to as GeForce Expertise, bundled with the chipmaker’s popular GTX GPU, is flawed and opens the doorway to a distant attacker that can exploit the bug to steal or manipulate facts on a susceptible Windows laptop or computer.

NVIDIA notified clients late last 7 days of the bug and unveiled a software patch for the flaw, which is current in its GeForce Experience (versions 3.21 and prior) Windows software. A 3.23 GeForce update is readily available now to mitigate the bug.

The bug is tracked as CVE‑2021‑1073, with a CVSS severity rating of 8.3 (superior). The organization warned: “NVIDIA GeForce Practical experience application contains a vulnerability in which, if a person clicks on a maliciously formatted connection that opens the GeForce Encounter login web page in a new browser tab in its place of the GeForce Knowledge software and enters their login facts, the malicious internet site can get entry to the token of the person login session. These an attack may lead to these qualified users’ facts remaining accessed, altered, or lost.”

Who is Susceptible to the NVIDIA Spoofing-Attack Bug?

The conditions for an attack, recognized as a spoofing attack, contain an adversary with network or remote access to the vulnerable Computer system. In accordance NVIDIA details, simply because the victim should be coaxed into clicking on a destructive connection, the attack is regarded as intricate, decreasing the risk of a profitable exploitation.

The spoofing attack vulnerability is tied to incorrect processing of “special formatted links” in the NVIDIA GeForce Knowledge software program. “A distant attacker can build a specially crafted website link that opens the GeForce Knowledge login site in a new browser tab as an alternative of the GeForce Experience application and enters their login information, the malicious web-site can get obtain to the token of the consumer login session,” in accordance to a breakdown of the bug posted to Cybersecurity Aid.

NVIDIA did not indicate if this vulnerability has been exploited. Nonetheless, performing exploits of the attack are not publicly out there.

How to Guard Your NVIDIA’s GeForce Software package from Attacks

All those afflicted are advised to down load and put in the computer software update through the GeForce Experience Down load site or to just open up the program consumer, which will then routinely update the software package.

GeForce Knowledge is absolutely free program bundled with NVIDIA’s graphics cards and especially designed to improve Computer system gaming general performance. It makes it possible for end users to check and enhance method efficiency, get in-recreation screenshots, and history or livestream game enjoy to communities this kind of as Twitch.

Past Monday, the chipmaker also reported 9 large-severity bugs in its Jetson SoC framework. The flaws were tied to the way the firmware dealt with minimal-degree cryptographic algorithms.

Previous GeForce Experience bugs have involved a software patch issued in October that preset a flaw that enabled code execution and disorders ripe for a denial-of-company (DoS) attack.  In March 2019, NVIDIA warned of security issues affecting its GeForce brand name, which includes an issue influencing GeForce Experience in 2019 that could direct to code execution or DoS of goods if exploited.

Join Threatpost for “Tips and Methods for Better Threat Hunting” — a Dwell occasion on Wed., June 30 at 2:00 PM ET in partnership with Palo Alto Networks. Understand from Palo Alto’s Device 42 gurus the most effective way to hunt down threats and how to use automation to aid. Register HERE for absolutely free!