Security Bulletin: NVIDIA GPU Display Driver - July 2024

NVIDIA has released a software security update for NVIDIA GPU Display Driver to address the issues that are disclosed in this bulletin.

To protect your system, download and install this software update through the NVIDIA Driver Downloads page or, for the vGPU software and Cloud Gaming updates, through the NVIDIA Licensing Portal.

Go to NVIDIA Product Security.

Details

This section provides a summary of potential vulnerabilities that this security update addresses and their impact. Descriptions use CWE™, and base scores and vectors use CVSS v3.1 standards.

NVIDIA GPU Display Driver

CVE ID	Description	Vector	Base Score	Severity	CWE	Impacts
CVE‑2024‑0107	NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.	AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	7.8	High	CWE‑125	Code execution, denial of service, escalation of privileges, information disclosure, data tampering

The NVIDIA risk assessment is based on an average of risk across a diverse set of installed systems and might not represent the true risk to your local installation. NVIDIA recommends consulting a security or IT professional to evaluate the risk to your specific configuration.

Security Updates for NVIDIA GPU Display Driver

The following table lists the NVIDIA software products affected, versions affected, and the updated version available from nvidia.com that includes this security update. Download the updates from the NVIDIA Driver Downloads page.

CVE IDs Addressed	Software Product	Operating System	Driver Branch	Affected Driver Versions	Updated Driver Version
CVE‑2024‑0107	GeForce	Windows	R555	All driver versions prior to 556.12	556.12
Windows 10 and 11	R470	All driver versions prior to 475.14 for support of GeForce Kepler desktop	475.14
Windows 7 and 8.x	R470	All driver versions prior to 475.14	475.14
NVIDIA RTX/ Quadro, NVS	Windows	R550	All driver versions prior to 552.74	552.74
R535	All driver versions prior to 538.78	538.78
R470	All driver versions prior to 475.14	475.14
Tesla	Windows	R550	All driver versions prior to 552.74	552.74
R535	All driver versions prior to 538.78	538.78
R470	All driver versions prior to 475.14	475.14

Notes:

• Your computer hardware vendor might provide you with Windows GPU display driver versions including 556.12, 552.74, 538.78, and 475.14, which also contain the security updates.
• The table above might not be a comprehensive list of all affected supported versions or branch releases and might be updated as more information becomes available.
• Earlier software branch releases that support these products might also be affected. If you are using an earlier branch release for which an updated version is not listed, upgrade to the latest branch release.

Security Updates for NVIDIA vGPU Software

The following table lists the NVIDIA software products affected, versions affected, and the updated version that includes this security update. Log in to the NVIDIA Enterprise Application Hub to download updates from the NVIDIA Licensing Portal.

CVE IDs Addressed	vGPU Software Component	Operating System	Affected Versions	Updated Version
vGPU Software	Driver	vGPU Software	Driver
CVE‑2024‑0107	Guest driver	Windows	All versions up to and including 17.2	552.55
All versions up to and including 16.6	538.67	16.7	538.78
All versions up to and including 13.11	475.06	13.12	475.14

Notes:

• The table above might not be a comprehensive list of all affected supported versions or branch releases and might be updated as more information becomes available.
• Earlier software branch releases that support these products might also be affected. If you are using an earlier branch release for which an update version is not listed, upgrade to the latest branch release.

Security Updates for NVIDIA Cloud Gaming

The following table lists the NVIDIA software products affected, versions affected, and the updated version that includes this security update. Download the updates through the NVIDIA Licensing Portal.

CVE IDs Addressed	Cloud Gaming Component	Operating System	Affected Versions	Updated Version
Cloud Gaming Software	Driver	Cloud Gaming Software	Driver
CVE‑2024‑0107	Guest driver	Windows	All versions up to and including the June 2024 release	555.99

Mitigations

Refer to Security Updates for NVIDIA GPU Display Driver, Security Updates for NVIDIA vGPU Software, or Security Updates for NVIDIA Cloud Gaming for the version to install.

Acknowledgements

NVIDIA thanks the following people for reporting the issues:

CVE‑2024‑0107: Piotr Bania - Cisco Talos