Nvidia cybersecurity teams reported a set of security vulnerabilities in the driver of their graphics processing unit (GPU) whose exploit would allow multiple attacks to be deployed, including denial of service (DoS), arbitrary code execution, and information theft.

According to the report, the most severe of these flaws (CVE-2021-1074) exists in the display driver installer and allows threat actors with access to the local system to replace an application resource with a malicious file. The vulnerability received a score of 7.5/10 on the Common Vulnerability Scoring System (CVSS) scale.

Another reported flaw (CVE-2021-1075) received a CVSS score of 7.3 and resides on all versions of NVIDIA Windows GPU Display Driver for Windows. This mechanism contains a flaw in the kernel-mode layer driver (nvlddmkm.sys) for DxgkDdiEscape where the program removes the reference to a pointer that contains a location for memory that is no longer valid, which can lead to multiple attacks.

In terms of severity, the following two flaws received CVSS scores of 6.6/10 and reside on all versions of NVIDIA GPU Display Driver for Windows and Linux systems. Finally, the lowest-scoring flaw was tracked as CVE-2021-1078 and resides in the nvlddmkm.sys kernel driver, in which a dereference on the NULL pointer could lead to a massive flaw in the compromised system.

Security patches to fix these flaws are now available, so Nvidia security team members recommend users of affected deployments update as soon as possible.  

In addition to these flaws, Nvidia reported finding eight vulnerabilities in its software, which could have a different impact on affected resources. Among the reported flaws are:

  • CVE‑2021‑1080: A certain input data is not validated, which may conduct to a DoS condition
  • CVE-2021-1081: A security flaw in the guest kernel mode driver and vGPU manager could lead to a remote code execution condition
  • CVE‑2021‑1082: A vulnerability in the vGPU Manager (vGPU plugin), stemming from an input length not being validated
  • CVE‑2021‑1083:  A security flaw in the guest kernel-mode driver could expose the affected system to multiple cyberattack variants

To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.