The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3418 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3418-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     May 11, 2023                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nvidia-graphics-drivers-legacy-390xx     Version        : 390.157-1~deb10u1     CVE ID         : CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677                      CVE-2022-34680 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259     Debian Bug     : 1025281

    NVIDIA has released a software security update for the NVIDIA GPU Display     Driver R390 linux driver branch. This update addresses issues that may lead to     denial of service, escalation of privileges, information disclosure, data     tampering or undefined behavior.


    CVE-2022-34670

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer handler, where an unprivileged regular user can         cause truncation errors when casting a primitive to a primitive of         smaller size causes data to be lost in the conversion, which may         lead to denial of service or information disclosure.

    CVE-2022-34674

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer handler, where a helper function maps more         physical pages than were requested, which may lead to undefined         behavior or an information leak.

    CVE-2022-34675

        NVIDIA Display Driver for Linux contains a vulnerability in the         Virtual GPU Manager, where it does not check the return value from a         null-pointer dereference, which may lead to denial of service.

    CVE-2022-34677

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer handler, where an unprivileged regular user can         cause an integer to be truncated, which may lead to denial of         service or data tampering.

    CVE-2022-34680

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer handler, where an integer truncation can lead to         an out-of-bounds read, which may lead to denial of service.

    CVE-2022-42257

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer (nvidia.ko), where an integer overflow may lead to         information disclosure, data tampering or denial of service.

    CVE-2022-42258

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer (nvidia.ko), where an integer overflow may lead to         denial of service, data tampering, or information disclosure.

    CVE-2022-42259

        NVIDIA GPU Display Driver for Linux contains a vulnerability in the         kernel mode layer (nvidia.ko), where an integer overflow may lead to         denial of service.

    For Debian 10 buster, these problems have been fixed in version     390.157-1~deb10u1.

    We recommend that you upgrade your nvidia-graphics-drivers-legacy-390xx packages.

    For the detailed security status of     nvidia-graphics-drivers-legacy-390xx please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/nvidia-graphics-drivers-legacy-390xx

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3418 : libegl-nvidia-legacy-390xx0 - security update

high Nessus Plugin ID 175576

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 8:38 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501222038
Version 1.0 May 14, 2023, 6:02 AM New Plugin Feed: 202305140602