NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after the end of the buffer. A successful exploit of this vulnerability may lead to denial of service and data tampering.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - NVIDIA GPU Display Driver for WIndows and Linux contains a vulnerability in the kernel mode data handler, where an     unprivileged regular user can cause integer overflow, which may lead to denial of service, information disclosure,     and data tampering. (CVE-2022-42665)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after     the end of the buffer. A successful exploit of this vulnerability may lead to denial of service and data tampering.     (CVE-2024-0074)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer     dereference by accessing passed parameters the validity of which has not been checked. A successful exploit of     this vulnerability may lead to denial of service and limited information disclosure. (CVE-2024-0075)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in     a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service. (CVE-2024-0078)

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Display Driver for WIndows and Linux contains a vulnerability in the kernel mode data handler, where an     unprivileged regular user can cause integer overflow, which may lead to denial of service, information disclosure,     and data tampering. (CVE-2022-42665)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after     the end of the buffer. A successful exploit of this vulnerability may lead to denial of service and data tampering.     (CVE-2024-0074)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer     dereference by accessing passed parameters the validity of which has not been checked. A successful exploit of     this vulnerability may lead to denial of service and limited information disclosure. (CVE-2024-0075)

  - NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, where it allows a guest OS to allocate     resources for which the guest OS is not authorized. A successful exploit of this vulnerability may lead to code     execution, denial of service, escalation of privileges, information disclosure, and data tampering. (CVE-2024-0077)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user in     a guest can cause a NULL-pointer dereference in the host, which may lead to denial of service. (CVE-2024-0078)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user     in a guest VM can cause a NULL-pointer dereference in the host. A successful exploit of this vulnerability may     lead to denial of service. (CVE-2024-0079) 	Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0770-1 advisory.

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an integer overflow may lead to information disclosure or data tampering. (CVE-2022-42265)

  - NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory     location after the end of the buffer. A successful exploit of this vulnerability may lead to denial of     service and data tampering. (CVE-2024-0074)

  - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-     pointer dereference by accessing passed parameters the validity of which has not been checked. A     successful exploit of this vulnerability may lead to denial of service and limited information disclosure.
    (CVE-2024-0075)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0772-1 advisory.

  - NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where     an integer overflow may lead to information disclosure or data tampering. (CVE-2022-42265)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191744	NVIDIA Linux GPU Display Driver (February 2024)	Nessus	Misc.	high
191743	NVIDIA Virtual GPU Manager Multiple Vulnerabilities (February 2024)	Nessus	Misc.	high
191642	SUSE SLES15 Security Update : kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed (SUSE-SU-2024:0770-1)	Nessus	SuSE Local Security Checks	high
191624	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed (SUSE-SU-2024:0772-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-0074

high

Tenable Plugins

high

high

high

high