Businesses urged to patch against 'highly severe' Nvidia flaws

GeForce, Quadro and Tesla GPUs are affected by bugs that could lead to local code execution

A host of Nvidia graphics chips are affected by five dangerous vulnerabilities ranging in severity, including one that could allow an attacker to execute malicious code locally.

Organisations using NVIDIA's GeForce, Quadro and Tesla graphics processing units (GPUs) have been urged to update their drivers immediately after the graphics giant published details around the recently-discovered flaws.

The most severe flaw, dubbed CVE-2019-5683 and rated 8.8 via CVSS V3 standards, involves a flaw in a component of the Windows GPU Display Driver software. If exploited, a malicious actor can install malware on a victim's machine.

More specifically, if an attacker has gained access to the user mode video driver trace logger component, they are able to create a hard link because the software does not check for such an attack.

Successfully taking advantage of this vulnerability could lead to local code execution, denial of service, as well as privilege escalation attacks.

Elsewhere, two separate flaws with DirectX drivers, each given a severity rating of 7.8, would also allow an attacker to execute malicious code or launch a denial of service attack.

Both flaws were first discovered by Cisco Talos security researcher Piotr Bania, who noted that VMware's ESXi, Workstation and Fusion products are affected by the out-of-bounds write vulnerability triggered through a specially crafted shader file.

Quadro graphics chips are conventionally used in workstations that are used to run profession computer-aided design (CAD) and similar heavy-duty graphics work, alongside machine learning applications and intensive calculations.

Tesla GPUs, meanwhile, are industrial units deployed on server platforms, given these chips' capacity to perform highly precise computations.

Businesses likely to deploy either variant of the Nvidia GPU, as well as GeForce GPUs fitted into notebook devices, are being urged to upgrade their drivers as soon as possible to the latest version.

These flaws are rated highly severe, but require an attacker to have close physical proximity to a targeted device, so are far less likely to be executed compared with remote-code execution vulnerabilities.

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

8 of the most secure web browsers
web browser

8 of the most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
The Xbox Series X shows how far the cloud still has to go
Cloud

The Xbox Series X shows how far the cloud still has to go

25 Sep 2020