The gaming- and AI-welcoming graphics accelerators can open up the door to a range of cyberattacks.
Nvidia has disclosed a team of security vulnerabilities in the Nvidia graphics processing unit (GPU) display screen driver, which could matter players and other people to privilege-escalation attacks, arbitrary code execution, denial of support (DoS) and information and facts disclosure.
Meanwhile, the Nvidia digital GPU (vGPU) software also has a team of bugs that could direct to a array of similar attacks.
5 GPU Screen Driver Security Bugs
The most extreme of the five bugs in the GPU display screen driver is tracked as CVE-2021-1074, which prices 7.5 out of 10 on the CVSS vulnerability scale, making it substantial-severity. It exists in the screen driver’s installer, and enables an attacker with area technique obtain to replace an software useful resource with malicious information. These an attack could lead to code execution, escalation of privileges, denial of support, or information disclosure.
Another high-severity bug, CVE-2021-1075, fees 7.3 on the CVSS scale. NVIDIA Windows GPU Screen Driver for Windows, all variations, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape wherever the method dereferences a pointer that incorporates a spot for memory that is no longer legitimate, which may perhaps lead to code execution, denial of support, or escalation of privileges.
Two medium-severity flaws, CVE-2021-1076 and CVE-2021-1077, both level 6.6 on the CVSS scale. The former NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel method layer (nvlddmkm.sys or nvidia.ko) where by poor access regulate may direct to denial of provider, data disclosure, or data corruption. The latter NVIDIA GPU Exhibit Driver for Windows and Linux, R450 and R460 driver department, has a vulnerability where by the software program uses a reference count to handle a resource that is improperly current, which may perhaps direct to denial of provider.
And at last, the medium-severity CVE-2021-1078 costs 5.5 on the CVSS scale and NVIDIA Windows GPU Screen Driver for Windows, all versions, consists of a vulnerability in the kernel driver (nvlddmkm.sys) where a NULL pointer dereference may possibly guide to system crash.
8 Nvidia vGPU Application Vulnerabilities
In the meantime, Nvidia’s vGPU program has 8 different security holes. The virtualized GPU permits computing acceleration personalized for useful resource-intensive workloads like graphics-prosperous virtual workstations, information science and artificial intelligence.
The to start with 4 bugs are substantial-severity enter-validation bugs that can direct to details disclosure, information tampering or DoS.
- CVE‑2021‑1080 (7.8 on the CVSS scale): A vulnerability in the vGPU Supervisor (vGPU plugin), in which particular input information is not validated
- CVE‑2021‑1081 (7.8): A vulnerability in the visitor kernel manner driver and vGPU manager (vGPU plugin), in which an enter length is not validated
- CVE‑2021‑1082 (7.8): A vulnerability in the vGPU Manager (vGPU plugin), stemming from an input duration not remaining validated
- CVE‑2021‑1083 (7.8): A vulnerability in the guest kernel-mode driver and vGPU Manager (vGPU plugin), also arising from an input length not becoming validated.
The other four could lead to a wide variety of results if exploited:
- CVE‑2021‑1084 (7.8): A vulnerability in the visitor kernel-manner driver and vGPU Supervisor (vGPU plugin), in which an enter duration is not validated, which could guide to info tampering or DoS
- CVE‑2021‑1085 (7.3): A vulnerability in the vGPU Supervisor (vGPU plugin) could make it possible for an attacker to publish to a shared-memory locale and manipulate the info just after the info has been validated, which may lead to denial of support and escalation of privileges
- CVE‑2021‑1086 (7.1): A vulnerability in the vGPU Manager (vGPU plugin) enables friends to management unauthorized means, which may well direct to integrity and confidentiality reduction, or information and facts disclosure
- CVE‑2021‑1087 (5.5): A vulnerability in the vGPU Manager (vGPU plugin), could allow an attacker to retrieve facts that could lead to an tackle house structure randomization (ASLR) bypass, which in flip could crack open the door to memory-corruption bug exploitation.
Nvidia has released patches to mitigate all of the bugs, which works by using can down load at through the Nvidia Driver Downloads page or, for the vGPU software update, by way of the Nvidia Licensing Portal. Influenced edition tables are obtainable in Nvidia’s advisory, launched Friday.
Nvidia proceeds to address security bugs on a standard foundation. In January, it produced fixes tied to 16 CVEs across its graphics motorists and vGPU computer software, in its initially security update of 2021. And soon following, it issued patches for its Tesla-dependent GPUs and its Defend Tv lineup.
Down load our distinctive Cost-free Threatpost Insider Book, “2021: The Evolution of Ransomware,” to assist hone your cyber-protection approaches towards this growing scourge. We go beyond the standing quo to uncover what’s following for ransomware and the related emerging dangers. Get the complete tale and Down load the E book now – on us!
Some areas of this article are sourced from: