Security Bulletin: NVIDIA GeForce Experience Software Security Updates for Multiple Vulnerabilities When GameStream is Enabled

NVIDIA GeForce Experience contains vulnerabilities when GameStream is enabled which may lead to escalation of privileges, denial of service, or information disclosure. Go to NVIDIA Product Security.

Vulnerability Details

The following sections summarize the potential vulnerabilities. Descriptions use CWETM and risk assessments follow the CVSS V3 standard.

CVE-2018-6257

NVIDIA GeForce Experience contains a potential vulnerability when GameStream is enabled where improper access control may lead to a denial of service, escalation of privileges, or both.

CVSS V3 Base Score: 8.8 CVSS V3 Vector: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2018-6258

NVIDIA GeForce Experience contains a potential vulnerability during GameStream installation where an attacker who has system access can potentially conduct a Man-in-the-Middle (MitM) attack to obtain sensitive information.

CVSS V3 Base Score: 7.7 CVSS V3 Vector: AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:H

CVE-2018-6259

NVIDIA GeForce Experience contains a potential vulnerability when GameStream is enabled, an attacker has system access, and certain system features are enabled, where limited information disclosure may be possible.

CVSS V3 Base Score: 7.3 CVSS V3 Vector: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

NVIDIA’s risk assessment is based on an average of risk across a diverse set of installed systems and may not represent the true risk of your local installation. NVIDIA recommends consulting a security or IT professional to evaluate the risk of your specific configuration.

Affected Software

The following table lists supported software and its affected driver versions. All driver branches prior to the versions listed in the Affected Versions column are also impacted by the issues in this bulletin.

CVEs	Software Product	Operating System	Affected Version
CVE-2018-6257 CVE-2018-6258 CVE-2018-6259	GeForce Experience 3.x	Windows	All versions prior to 3.14.1

Software Security Updates

The following table lists the software version containing the security updates for the issues described in this bulletin. If you are using unsupported software versions or earlier driver branches that are no longer supported, upgrade to the updated supported version listed.

Software Product	Product Series	Operating System	Updated Version
GeForce Experience	3.x	Windows	GeForce Experience 3.14.1

Download the updates from the NVIDIA GeForce Experience Downloads page.

Mitigations

None.

Acknowledgements

None.