Businesses urged to patch against 'highly severe' Nvidia flaws

GeForce, Quadro and Tesla GPUs are affected by bugs that could lead to local code execution

A host of Nvidia graphics chips are affected by five dangerous vulnerabilities ranging in severity, including one that could allow an attacker to execute malicious code locally.

Organisations using NVIDIA's GeForce, Quadro and Tesla graphics processing units (GPUs) have been urged to update their drivers immediately after the graphics giant published details around the recently-discovered flaws.

The most severe flaw, dubbed CVE-2019-5683 and rated 8.8 via CVSS V3 standards, involves a flaw in a component of the Windows GPU Display Driver software. If exploited, a malicious actor can install malware on a victim's machine.

More specifically, if an attacker has gained access to the user mode video driver trace logger component, they are able to create a hard link because the software does not check for such an attack.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Successfully taking advantage of this vulnerability could lead to local code execution, denial of service, as well as privilege escalation attacks.

Elsewhere, two separate flaws with DirectX drivers, each given a severity rating of 7.8, would also allow an attacker to execute malicious code or launch a denial of service attack.

Both flaws were first discovered by Cisco Talos security researcher Piotr Bania, who noted that VMware's ESXi, Workstation and Fusion products are affected by the out-of-bounds write vulnerability triggered through a specially crafted shader file.

Quadro graphics chips are conventionally used in workstations that are used to run profession computer-aided design (CAD) and similar heavy-duty graphics work, alongside machine learning applications and intensive calculations.

Tesla GPUs, meanwhile, are industrial units deployed on server platforms, given these chips' capacity to perform highly precise computations.

Businesses likely to deploy either variant of the Nvidia GPU, as well as GeForce GPUs fitted into notebook devices, are being urged to upgrade their drivers as soon as possible to the latest version.

Advertisement - Article continues below

These flaws are rated highly severe, but require an attacker to have close physical proximity to a targeted device, so are far less likely to be executed compared with remote-code execution vulnerabilities.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/malware/33080/hackers-abuse-linkedin-dms-to-plant-malware
malware

Hackers abuse LinkedIn DMs to plant malware

25 Feb 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019
Visit/antivirus/28144/best-antivirus
antivirus

Best antivirus for Windows 10

3 Sep 2019
Visit/security/malware/28083/the-five-best-free-malware-removal-tools
Security

Best free malware removal tools 2019

8 Mar 2019

Most Popular

Visit/operating-systems/microsoft-windows/354297/this-exploit-could-give-users-free-windows-7-updates
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019
Visit/business/business-strategy/354304/ex-apple-cpu-architect-accuses-the-firm-of-invading-privacy
Business strategy

Ex-Apple CPU architect accuses the firm of invading privacy

10 Dec 2019
Visit/security/vulnerability/354309/patch-issued-for-critical-windows-bug
vulnerability

Patch issued for critical Windows bug

11 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019