Nvidia GPU Driver Bugs Threaten Device Takeover & More

A new update from Nvidia for its GPU Display Driver includes fixes for a full 29 security vulnerabilities, seven with a base score of more than 7. 

The company’s graphics cards are built to accelerate computing processing to support real-time or data-intensive applications. As such, they’re known for their use by gamers, graphic designers, and other creative producers, and for artificial intelligence and machine learning. Impacted software products for the update specifically include GeForce, Studio, Nvidia RTX, Quadro, NVS, and Tesla.

The most serious of the bugs are two flaws that exist in the user mode layer for Windows versions, both of which could allow an unauthorized user to execute code, escalate privileges, launch denial-of-service attacks, and achieve data compromise and disclosure, according to the chipmaker:

• CVE‑2022‑34669 (CVSS score of 8.8): An unprivileged regular user can access or modify system files or other files that are critical to the application.
• CVE‑2022‑34671 (CVSS score of 8.7): An unprivileged regular user can cause an out-of-bounds write.

The display driver for Linux also received a number of updates in this latest security update. 

“Earlier software branch releases that support these products may also be affected,” the Nvidia security update said. “If you are using an earlier branch release for which an update version is not listed above, upgrade to the latest branch release.”