NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service.

The remote host is affected by the vulnerability described in GLSA-202405-28 (NVIDIA Drivers: Multiple Vulnerabilities)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where unexpected untrusted data     is parsed, which may lead to code execution, denial of service, escalation of privileges, data tampering,     or information disclosure. (CVE-2023-25515)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an     unprivileged user can cause an integer overflow, which may lead to information disclosure and denial of     service. (CVE-2023-25516)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a     NULL-pointer dereference may lead to denial of service. (CVE-2023-31022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4429-1 advisory.

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a     NULL-pointer dereference may lead to denial of service. (CVE-2023-31022)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4427-1 advisory.

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a     NULL-pointer dereference may lead to denial of service. (CVE-2023-31022)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged     regular user can cause a NULL-pointer dereference, which may lead to denial of service. (CVE‑2023‑31018)

  - NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin),     where a malicious user in the guest VM can cause a NULL-pointer dereference, which may lead to denial of service.     (CVE‑2023‑31021)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of     privilege to escalate privileges when an administrator is updating GPU drivers, which may lead to escalation of     privileges. (CVE-2023-31027)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A display driver installed on the remote Windows host is affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write     arbitrary data to privileged locations by using reparse points. A successful exploit of this vulnerability     may lead to code execution, denial of service, escalation of privileges, information disclosure, or data     tampering. (CVE-2023-31017)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver     implementation does not restrict or incorrectly restricts access from the named pipe server to a     connecting client, which may lead to potential impersonation to the client's secure context.
    (CVE-2023-31019)

  - NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels     of privilege to escalate privileges when an administrator is updating GPU drivers, which may lead to     escalation of privileges. (CVE-2023-31027)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the driver's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195168	GLSA-202405-28 : NVIDIA Drivers: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
185604	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed (SUSE-SU-2023:4429-1)	Nessus	SuSE Local Security Checks	medium
185603	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed (SUSE-SU-2023:4427-1)	Nessus	SuSE Local Security Checks	medium
185434	NVIDIA Virtual GPU Manager Multiple Vulnerabilities (October 2023)	Nessus	Misc.	high
185433	NVIDIA Windows GPU Display Driver (October 2023)	Nessus	Windows	high
185432	NVIDIA Linux GPU Display Driver (October 2023)	Nessus	Misc.	medium

Detections

Analytics

CVE-2023-31022

medium

Tenable Plugins

high

medium

medium

high

high

medium