Weekly threat roundup: Nvidia, BitLocker, and HackerOne

The most dangerous and pressing flaws from the week gone by

Patch management is far easier a process said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Nvidia GPU display driver vulnerabilities 

Patches released for the Nvidia GPU display driver have addressed vulnerabilities that, if exploited, may have lead to denial of service, code execution, escalation of privileges or information disclosure.

The flaws, numbering 11 in total, were present in the GeForce, Quadro, NVS and Tesla graphics card drivers, as well as in the firm’s vGPU software used in virtual machines. These have been tagged from CVE‑2020‑5979 to CVE‑2020‑5989, and range in severity from a CVSS base score of 4.4 to 8.8.

The most serious flaw lies in the vGPU plugin and host driver kernel module of the Nvidia Virtual GPU Manager. Specifically, it presents the potential to write to a memory location outside the intended boundary of the frame buffer memory allocated to guest operating systems. It could lead to a denial of service or information disclosure.

While the majority of patches are available now, updated drivers for Nvidia GeForce cards won’t be available until 5 October.

BitLocker ‘sleep mode’ bypass

A BitLocker flaw can be exploited to break the full disk encryption technology that comes packaged with Windows 10 devices, according to the Daily Swig.

An update to the BitLeaker tool built for Windows 10 can exploit a vulnerability, tagged CVE-2020-0526, in a device’s sleeping state to bypass full-disk encryption, as outlined by researcher Seunghun Han, at the Black Hat Asia event.

This flaw is embedded in the firmware-based Trusted Platform Module (fTPM) – specifically in the Intel Platform Trust Technology (PTT) – on certain motherboards.

The bug was also found to lead to privilege escalation, should hackers successfully exploit it, although all components barring one, the ASUS Q170M-C motherboard, have been patched.

HackerOne prototype pollution flaw 

A ‘prototype pollution’ vulnerability in a JavaScript library used by bug bounty platform HackerOne could have allowed hackers to stage phishing attacks.

This type of flaw, which is normally found in prototype-based languages like JavaScript, can allow cyber criminals to manipulate the behaviour of an application by modifying its code while it’s running.

Discovered by developer William Bowling, the vulnerability could have allowed an attacker to inject malicious HTML and JavaScript code into the HackerOne website. He was searching for cross-site scripting (XSS) flaws when he found it.

Authentication bypass flaws in router chipsets 

Chipsets found in multiple routers – manufactured by Mediatek, Qualcomm (Atheros) and Realtek – contain a partial authentication bypass flaw that could allow an attacker to send malicious packets through protected networks.

Related Resource

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

Tagged as CVE-2019-18989, CVE-2019-18990, and CVE-2019-18991, the flaws were first discovered by Synopsys last year and disclosed to both the chipset and router manufacturers, which included Zyxel, Netgear and D-Link, among others. By injecting malicious packets into vulnerable networks, hackers are able to target active systems.

Mediatek and Realtek have said that patches will be made available upon request, while Qualcomm (Atheros) has said the identified chipsets have all reached end-of-life and have therefore been discontinued.

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

Improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Recommended

UK's first government cyber strategy aims to bolster public sector defences
cyber security

UK's first government cyber strategy aims to bolster public sector defences

25 Jan 2022
IT Pro Podcast Special Edition: Learning to live with risk
Sponsored

IT Pro Podcast Special Edition: Learning to live with risk

25 Jan 2022
Russia's "politically motivated" REvil raid could be used as leverage, experts warn
ransomware

Russia's "politically motivated" REvil raid could be used as leverage, experts warn

17 Jan 2022
Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp
phishing

Meta files lawsuit to uncover hackers targeting Facebook, WhatsApp

21 Dec 2021

Most Popular

Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022
Sony pulls out of MWC 2022
Business operations

Sony pulls out of MWC 2022

14 Jan 2022
Synology DiskStation DS2422+ review: A cube of great capacity
network attached storage (NAS)

Synology DiskStation DS2422+ review: A cube of great capacity

10 Jan 2022