Critical Security Updates Released for Nvidia GPU and vGPU Software

EXECUTIVE SUMMARY

Nvidia has released critical updates for its GPU and vGPU software to address five security defects, including three high-severity vulnerabilities. The most severe flaw, tracked as CVE-2024-0090, affects both Windows and Linux drivers. It could potentially allow arbitrary code execution, data tampering, privilege escalation, or denial-of-service (DoS) conditions due to an out-of-bounds write.[emaillocker id="1283"]

Additionally, CVE-2024-0089 impacts Windows drivers, leading to potential code execution, information disclosure, and data tampering.

CVE-2024-0091, another high-severity issue, involves an untrusted pointer dereference flaw in Nvidia’s Windows and Linux drivers, which could result in DoS conditions, information disclosure, and data tampering.

Two medium-severity vulnerabilities are addressed as well. These could result in information disclosure on Linux and DoS on both operating systems.

Furthermore, updates to Nvidia’s vGPU software address five additional bugs. Among these are two high-severity issues, tracked as CVE-2024-0099 and CVE-2024-0084, which could cause information disclosure, privilege escalation, data tampering, or DoS conditions. Users are strongly encouraged to apply these updates immediately to mitigate potential security risks.

RECOMMENDATION:

• We strongly recommend you update to following versions.

REFERENCES:

The following reports contain further technical details:

https://www.securityweek.com/nvidia-patches-high-severity-gpu-driver-vulnerabilities/