For the NVIDIA Quadro, NVS, GeForce, and Tesla products, NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) handler where a missing permissions check may allow users to gain access to arbitrary physical memory, leading to an escalation of privileges.

The version of the NVIDIA GPU display driver installed on the remote Windows host is 340.x, 341.x, or 342.x prior to 342.00, or 375.x prior to 375.63. It is, therefore, affected by multiple vulnerabilities :

  - An array-indexing error exists in nvlddmkm.sys due to     improper validation of input. A local attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code with elevated     privileges. (CVE-2016-7381)

  - A flaw exists in nvlddmkm.sys due to missing permission     checks. A local attacker can exploit this to disclose     arbitrary memory contents and gain elevated privileges.
    (CVE-2016-7382)

  - A flaw exists in nvlddmkm.sys when handling memory     mapping that allows a local attacker to cause a denial     of service condition or the execution of arbitrary code     with elevated privileges. (CVE-2016-7383)

  - A flaw exists in nvlddmkm.sys when handling     UVMLiteController device IO control input and output     lengths. A local attacker can exploit this to execute     arbitrary code with elevated privileges. (CVE-2016-7384)

  - An untrusted pointer dereference flaw exists in     nvlddmkm.sys when handling DxgDdiEscape ID 0x700010d. A     local attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code     with elevated privileges. (CVE-2016-7385)

  - A flaw exists in nvlddmkm.sys when handling DxgDdiEscape     ID 0x70000d4 that allows a local attacker to disclose     uninitialized memory contents. (CVE-2016-7386)

  - A flaw exists in nvlddmkm.sys when handling DxgDdiEscape     ID 0x600000d that allows a local attacker to cause a     denial of service condition or the execution of     arbitrary code with elevated privileges. (CVE-2016-7387)

  - A NULL pointer dereference flaw exists in nvlddmkm.sys     that allows a local attacker to cause a denial of     service condition or the execution of arbitrary code     with elevated privileges in certain unsafe     configurations. (CVE-2016-7388)

  - An array-indexing error exists in nvlddmkm.sys when     handling DxgDdiEscape ID 0x7000194 that allows a local     attacker to cause a denial of service condition or the     execution of arbitrary code with elevated privileges.
    (CVE-2016-7390)

  - A flaw exists in nvlddmkm.sys when handling DxgDdiEscape     ID 0x100010b that allows a local attacker to cause a     denial of service condition or the execution of     arbitrary code with elevated privileges. (CVE-2016-7391)

  - A flaw exists in nvlddmkm.sys when handling DxgDdiEscape     ID 0x7000014 that allows a local attacker to cause a     denial of service condition or the execution of     arbitrary code with elevated privileges. (CVE-2016-8805)

  - An untrusted pointer dereference flaw exists in     nvlddmkm.sys when handling DxgDdiEscape ID 0x5000027     that allows a local attacker to cause a denial of     service condition or the execution of arbitrary code     with elevated privileges. (CVE-2016-8806)

  - A stack-based buffer overflow condition exists in     nvlddmkm.sys when handling DxgDdiEscape ID 0x10000e9     that allows a local attacker to cause a denial of     service condition or the execution of arbitrary code     with elevated privileges. (CVE-2016-8807)

  - A buffer overflow condition exists in nvlddmkm.sys when     handling DxgDdiEscape ID 0x70000d that allows a local     attacker to cause a denial of service condition or the     execution of arbitrary code with elevated privileges.
    (CVE-2016-8808)

  - A buffer overflow condition exists in nvlddmkm.sys when     handling DxgDdiEscape ID 0x70001b2 that allows a local     attacker to cause a denial of service condition or the     execution of arbitrary code with elevated privileges.
    (CVE-2016-8809)

  - A buffer overflow condition exists in nvlddmkm.sys when     handling DxgDdiEscape ID 0x100009a that allows a local     attacker to cause a denial of service condition or the     execution of arbitrary code with elevated privileges.
    (CVE-2016-8810)

  - A flaw exists in nvlddmkm.sys driver when handling     DxgDdiEscape ID 0x7000170 that allows a local attacker     to cause a denial of service condition or the execution     of arbitrary code with elevated privileges.
    (CVE-2016-8811)

  - A stack-based overflow condition exists in     nvstreamkms.sys when handling executable paths. A local     attacker can exploit this to execute arbitrary code with     elevated privileges. Note that this vulnerability only     affects systems that also have GeForce Experience     software installed. (CVE-2016-8812)

The version of the NVIDIA GPU display driver installed on the remote Linux host is 304.x prior to 304.132, 340.x prior to 340.98, 361.93.x prior to 361.93.03, 367.x prior to 367.55, or 370.x prior to 370.28.
It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the kernel-mode layer (nvidia.ko)     handler related to missing permission checks. A local     attacker can exploit this to disclose arbitrary memory     contents and gain elevated privileges. (CVE-2016-7382)

  - A flaw exists in the kernel-mode layer (nvidia.ko)     handler related to improper memory mapping. A local     attacker can exploit this to disclose arbitrary memory     contents and gain elevated privileges. (CVE-2016-7389)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3122-1 advisory.

    It was discovered that the NVIDIA graphics drivers incorrectly sanitized user mode inputs. A local     attacker could use this issue to possibly gain root privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
94576	NVIDIA Windows GPU Display Driver 340.x / 341.x / 342.x < 342.00 / 375.x < 375.63 Multiple Vulnerabilities	Nessus	Windows	high
94575	NVIDIA Linux GPU Display Driver 304.x < 304.132 / 340.x < 340.98 / 361.93.x < 361.93.03 / 367.x < 367.55 / 370.x < 370.28 Multiple Vulnerabilities	Nessus	Misc.	high
94573	Ubuntu 14.04 LTS / 16.04 LTS : NVIDIA graphics drivers vulnerabilities (USN-3122-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-7382

high

Tenable Plugins

high

high

high