NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.

The NVIDIA Virtual GPU Manager software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  -	NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds   write. A successful exploit of this vulnerability might lead to code execution, denial of service,   escalation of privileges, information disclosure, and data tampering.(CVE-2024-0090)

  -	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an   untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might   lead to denial of service, information disclosure, and data tampering. (CVE-2024-0091)

  - NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where the guest OS   could cause buffer overrun in the host. A successful exploit of this vulnerability might lead to   information disclosure, data tampering, escalation of privileges, and denial of service. (CVE-2024-0099) 	Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The NVIDIA GPU display driver software on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities, including the following:

  -	NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds   write. A successful exploit of this vulnerability might lead to code execution, denial of service,   escalation of privileges, information disclosure, and data tampering.(CVE-2024-0090)

  -	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an   untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might   lead to denial of service, information disclosure, and data tampering. (CVE-2024-0091)

  - NVIDIA GPU Driver for Windows and Linux contains a vulnerability where an improper check or improper   handling of exception conditions might lead to denial of service. (CVE-2024-0092)

Note that Nessus has not tested for the issue but has instead relied only on the application's self-reported version number.

A display driver installed on the remote Windows host is affected by multiple vulnerabilities, including the following:

  - NVIDIA GPU Display Driver for Windows contains a vulnerability where the information from a previous     client or another process could be disclosed. A successful exploit of this vulnerability might lead to     code execution, information disclosure, or data tampering. (CVE-2024-0089)

  -	NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds     write. A successful exploit of this vulnerability might lead to code execution, denial of service,     escalation of privileges, information disclosure, and data tampering.(CVE-2024-0090)

  -	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an     untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might     lead to denial of service, information disclosure, and data tampering. (CVE-2024-0091)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the driver's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2005-1 advisory.

    Security Update 550.90.07:

    - CVE-2024-0090: Fixed out of bounds write (bsc#1223356).
    - CVE-2024-0092: Fixed incorrect exception handling (bsc#1223356).
    - CVE-2024-0091: Fixed untrusted pointer dereference (bsc#1223356).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1990-1 advisory.

    Security Update 550.90.07:

    - CVE-2024-0090: Fixed out of bounds write (bsc#1223356).
    - CVE-2024-0092: Fixed incorrect exception handling (bsc#1223356).
    - CVE-2024-0091: Fixed untrusted pointer dereference (bsc#1223356).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
200467	NVIDIA Virtual GPU Manager Multiple Vulnerabilities (June 2024)	Nessus	Misc.	high
200466	NVIDIA Linux GPU Display Driver (June 2024)	Nessus	Misc.	high
200465	NVIDIA Windows GPU Display Driver (June 2024)	Nessus	Windows	high
200459	SUSE SLES15 Security Update : kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed (SUSE-SU-2024:2005-1)	Nessus	SuSE Local Security Checks	high
200402	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : kernel-firmware-nvidia-gspx-G06, nvidia-open-driver-G06-signed (SUSE-SU-2024:1990-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-0091

high

Tenable Plugins

high

high

high

high

high