NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposed by the GPU performance counters. Local user access is required. This is not a network or remote attack vector.

NVIDIA graphics driver contains a vulnerability that may allow access to application data processed on the GPU through a side channel exposed by the GPU performance counters. Local user access is required. This is not a network or remote attack vector.
(CVE-2018-6260)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3904-1 advisory.

    It was discovered that the NVIDIA graphics drivers incorrectly handled the GPU performance counters. A     local attacker could possibly use this issue to access the application data processed on the GPU.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability in the 3D vision component in which the stereo     service software, when opening a file, does not check for hard     links. This behavior may lead to code execution, denial of     service or escalation of privileges. (CVE-2019-5665)

  - A vulnerability in the kernel mode layer (nvlddmkm.sys) create     context command DDI DxgkDdiCreateContext in which the product     uses untrusted input when calculating or using an array index,     but the product does not validate or incorrectly validates the     index to ensure the index references a valid position within the     array, which may lead to denial of service or escalation of     privileges. (CVE-2019-5666)

  - A vulnerability in the kernel mode layer (nvlddmkm.sys) handler     for DxgkDdiSetRootPageTable in which the application dereferences     a pointer that it expects to be valid, but is NULL, which may     lead to code execution, denial of service or escalation of     privileges. (CVE-2019-5667)

It is also affected by additional vulnerabilities including denial of service, privilege escalation, code execution, and information disclosure vulnerabilities. See the vendor advisory for details.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by a local information disclosure vulnerability.

ID	Name	Product	Family	Severity
123090	Amazon Linux AMI : nvidia (ALAS-2019-1182)	Nessus	Amazon Linux Local Security Checks	medium
122716	Ubuntu 18.04 LTS : NVIDIA graphics drivers vulnerability (USN-3904-1)	Nessus	Ubuntu Local Security Checks	medium
122510	NVIDIA Windows GPU Display Driver Multiple Vulnerabilities (February 2019)	Nessus	Windows	high
122509	NVIDIA Linux GPU Display Driver Information Disclosure Vulnerability (CVE-2018-6260)	Nessus	Misc.	medium

Detections

Analytics

CVE-2018-6260

medium

Tenable Plugins

medium

medium

high

medium