NVIDIA Windows Privilege Delegation Escalation - Lenovo Support US

2016-06-2700:00:00

support.lenovo.com

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.0004 Low

EPSS

Percentile

5.7%

JSON

Lenovo Security Advisory: LEN-2015-008 **Potential Impact:**Escalation of Privilege Severity: Medium

Summary:
The NVIDIA Display Driver’s kernel administrator check improperly validates local client impersonation levels in some cases.

Description:
This vulnerability can only be exploited by a user with local access to the machine. Under certain conditions, a local user on the system can use improper impersonation behaviors of NVIDIA driver API’s to access resources that are intended for kernel access only. Under these conditions, this behavior may lead to privilege escalation of the local user account, leading to a system compromise.
This vulnerability affects all GPUs with Windows XP, Windows Vista, Windows 7, and Windows Server 2008/2008 R2 systems using NVIDIA GPU Display Driver components, or derived packages which use NVIDIA GPU Display Driver components.
Because Windows XP is no longer supported by Microsoft, NVIDIA will not be releasing an updated driver. For Windows Vista, we recommend installing the NVIDIA reference driver. Windows 8 and later Windows operating systems are not vulnerable due to changes in the implementation of the kernel function which the driver relies on for the security check.

Mitigation Strategy for Customers (what you should do to protect yourself):
Lenovo is currently qualifying the updated NVIDIA driver across all applicable impacted products… The updated driver will be posted to the Lenovo Support site for affected products as qualification testing is completed. Review the Product Impact section below for the list of affected products. Once the driver has been qualified for the affected product, you will be able to link directly to the driver download page. You should visit this security advisory often to find links to the latest qualified driver for your product.
If this vulnerability puts you at an unacceptable level of risk and you want to mitigate before the Lenovo-certified driver is available for your product, you can visit the NVIDIA security webpage (www.nvidia.com/security) to download and install the reference driver. Please be aware that the reference driver has not been qualified by Lenovo. If you experience problems as a result of installing the driver from the NVIDIA support site, please contact NVIDIA directly. When the Lenovo-certified driver is available for download from the Lenovo Support site, Lenovo recommends that you uninstall the NVIDIA reference driver, and upgrade to the Lenovo Support site version.

Product Affected

Click to expand for more info

ThinkStation

ThinkServer & Storage

Note: If you have added an NVIDIA graphics card to your system, you may be affected by this security vulnerability and should take the actions necessary to protect yourself.

ThinkPad

Note: If you have added an NVIDIA graphics card to your system, you may be affected by this security vulnerability and should take the actions necessary to protect yourself.

ThinkCentre

Note: If you have added an NVIDIA graphics card to your system, you may be affected by this security vulnerability and should take the actions necessary to protect yourself.

Software

Application	Status
Delopy Manager	Not affected
Diagnostic	Not affected
Easy Manager	Not affected
Easy Updater	Not affected
Energy manager	Not affected
OSPUT	Not affected
Partner Pack	Not affected
Power Planner	Not affected
TSMCLI	Not affected

Lenovo EMC

System	Status
LenovoEMC EZ Media & Backup (hm3)	Not affected
LenovoEMC Home Media Cloud Edition (hm2)	Not affected
LenovoEMC ix12-300r	Not affected
LenovoEMC ix2 (inc DL)	Not affected
LenovoEMC ix2-200	Not affected
LenovoEMC ix2-200 Cloud Edition	Not affected
LenovoEMC ix4-200d	Not affected
LenovoEMC ix4-200d (2.1.x firmware)	Not affected
LenovoEMC ix4-200d Cloud Edition	Not affected
LenovoEMC ix4-300d (inc DL)	Not affected
LenovoEMC px12-350r	Not affected
LenovoEMC px12-400r	Not affected
LenovoEMC px12-450r	Not affected
LenovoEMC px2-300d (inc NVR)	Not affected
LenovoEMC px4-300d (inc NVR)	Not affected
LenovoEMC px4-300r	Not affected
LenovoEMC px4-400d (inc NVR)	Not affected
LenovoEMC px4-400r	Not affected
LenovoEMC px6-300d	Not affected

**Acknowledgements:**None

Other information and references:

CVE-2015-1170
<http://nvidia.custhelp.com/app/answers/detail/a_id/3634>

Revision History:

Revision

Date

Description

—|—|—
1.5 | 2015-07-15 | Publish additional fixes
1.4 | 2015-06-30 | Publish additional fixes
1.3 | 2015-05-17 | Publish additional fixes
1.2 | 2015-03-25 | Publish additional fixes
1.1 | 2015-03-17 | Publish additional fixes
1.0 | 2015-03-03 | Initial release