NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability where the software uses a reference count to manage a resource that is incorrectly updated, which may lead to denial of service.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4935-1 advisory.

    It was discovered that the NVIDIA GPU display driver for the Linux kernel incorrectly performed access     control. A local attacker could use this issue to cause a denial of service, expose sensitive information,     or escalate privileges. (CVE-2021-1076)

    It was discovered that the NVIDIA GPU display driver for the Linux kernel incorrectly performed reference     counting. A local attacker could use this issue to cause a denial of service. (CVE-2021-1077)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode     layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service, information     disclosure, or data corruption (CVE-2021-1076).

  - NVIDIA GPU Display Driver for Windows and Linux, R450 and R460 driver branch, contains a vulnerability     where the software uses a reference count to manage a resource that is incorrectly updated, which may lead     to denial of service (CVE-2021-1077).

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

A display driver installed on the remote Windows host is affected by multiple vulnerabilities:
    
    - NVIDIA Windows GPU Display Driver for Windows, R390 driver branch, contains a vulnerability       in its installer where an attacker with local system access may replace an application resource       with malicious files. Such an attack may lead to code execution, escalation of privileges, denial       of service, or information disclosure (CVE-2021-1074).

    - NVIDIA Windows GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel       mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the program dereferences a pointer that       contains a location for memory that is no longer valid, which may lead to code execution, denial of       service, or escalation of privileges (CVE-2021-1075).

    - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel       mode layer (nvlddmkm.sys or nvidia.ko) where improper access control may lead to denial of service,       information disclosure, or data corruption (CVE-2021-1076).
    Note that Nessus has not attempted to exploit these issues but has instead relied only on the driver's   self-reported version number.

ID	Name	Product	Family	Severity
149306	Ubuntu 18.04 LTS / 20.04 LTS : NVIDIA graphics drivers vulnerabilities (USN-4935-1)	Nessus	Ubuntu Local Security Checks	high
149046	NVIDIA Linux GPU Display (April 2021)	Nessus	Misc.	high
149045	NVIDIA Windows GPU Display Driver (April 2021)	Nessus	Windows	high

Detections

Analytics

CVE-2021-1077

medium

Tenable Plugins

high

high

high