10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
0.016 Low
EPSS
Percentile
87.5%
NVIDIA has released a software security update for the NVIDIA GPU Display Driver. This update addresses issues that may lead to local code execution, denial of service, or escalation of privileges. To protect your system, download and install this software update through NVIDIA Driver Downloads Go to NVIDIA Product Security.
This section summarizes the potential impact that this security update addresses. Descriptions use CWE™, and base scores and vectors use CVSS V3 standards.
CVE | Description | Base Score | Vector |
---|---|---|---|
CVE‑2019‑5683 | NVIDIA Windows GPU Display Driver contains a vulnerability in the user mode video driver trace logger component. When an attacker has access to the system and creates a hard link, the software does not check for hard link attacks. This behavior may lead to code execution, denial of service, or escalation of privileges. | 8.8 | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
CVE‑2019‑5684 | NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution. | 7.8 | AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
CVE‑2019‑5685 | NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access to a shader local temporary array, which may lead to denial of service or code execution. | 7.8 | AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
CVE‑2019‑5686 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the software uses an API function or data structure in a way that relies on properties that are not always guaranteed to be valid, which may lead to denial of service. | 5.6 | AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H |
CVE‑2019‑5687 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which an incorrect use of default permissions for an object exposes it to an unintended actor, which may lead to information disclosure or denial of service. | 5.2 | AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L |
The NVIDIA risk assessment is based on an average of risk across a diverse set of installed systems and may not represent the true risk of your local installation. NVIDIA recommends consulting a security or IT professional to evaluate the risk to your specific configuration.
The following table lists the NVIDIA software products affected, versions affected, and the updated version available from nvidia.com that includes this security update. Download the updates from NVIDIA Driver Downloads.
Software Product | Operating System | Affected Versions | Updated Version |
---|---|---|---|
GeForce | Windows | All R430 versions prior to 431.60 | 431.60 |
Quadro, NVS | Windows | All R430 versions prior to 431.70 | 431.70 |
All R418 Versions prior to 426.00 |
426.00
All R410 versions | 412.40
All R390 versions prior to 392.56 | 392.56
Tesla | Windows | All R418 versions | 426.00
vGPU 4.x | Windows | vGPU software 4.8, which contains Windows driver version 370.35 | vGPU software 4.9, which contains Windows driver version 370.39
vGPU 8.x | Windows | vGPU software 8.0, which contains Windows driver version 425.31 | vGPU software 8.1, which contains Windows driver version 426.04
vGPU 9.x | Windows | vGPU software 9.0, which contains Windows driver version 431.02 | vGPU software 9.1, which contains Windows driver version 431.79
Notes:
None. See Security Updates for the versions to install.
NVIDIA thanks Piotr Bania of Cisco Talos for reporting the following issues:
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
0.016 Low
EPSS
Percentile
87.5%