Security Bulletin: NVIDIA GPU Display Driver - October 2021

NVIDIA has released a software security update for NVIDIA GPU Display Driver. This update addresses issues that may lead to multiple security impacts. To protect your system, download and install this software update through the NVIDIA Driver Downloads page or, for the vGPU software update, throu...

CVE-2021-42327

dplinksettingswrite in drivers/gpu/drm/amd/display/amdgpudm/amdgpudmdebugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parsewritebufferintoparam...

CVE-2021-42327

dplinksettingswrite in drivers/gpu/drm/amd/display/amdgpudm/amdgpudmdebugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parsewritebufferintoparam...

CVE-2021-42327

dplinksettingswrite in drivers/gpu/drm/amd/display/amdgpudm/amdgpudmdebugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parsewritebufferintoparam...

PT-2021-23571

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.15 Description The issue allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse write buffer into...

CVE-2021-1095

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys handlers for all control calls with embedded parameters where dereferencing an untrusted pointer may lead to denial of service...

CVE-2021-1095

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys handlers for all control calls with embedded parameters where dereferencing an untrusted pointer may lead to denial of service...

CVE-2021-1093

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary, and may lead to denial of...

CVE-2021-1094

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape where an out of bounds array access may lead to denial of service or information disclosure...

CVE-2021-1090

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for control calls where the software reads or writes to a buffer by using an index or pointer that references a memory location after the end of the buffer, which may lead to dat...

PT-2021-13486

Name of the Vulnerable Software and Affected Versions NVIDIA Windows GPU Display Driver for Windows affected versions not specified Description The NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape. This...

PT-2021-13485

Name of the Vulnerable Software and Affected Versions NVIDIA GPU Display Driver for Windows affected versions not specified Description The issue is related to an uncontrolled DLL loading path in the nvidia-smi component, which may lead to arbitrary code execution, denial of service, information...

CVE-2021-1092: Improper Link Resolution Before File Access

NVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel application where it is susceptible to a Windows file system symbolic link attack where an unprivileged attacker can cause the applications to overwrite privileged files, resulting in potential denial of...

CVE-2021-1096: NULL Pointer Dereference

NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape where dereferencing a NULL pointer may lead to a system crash...

CVE-2021-1089: Uncontrolled Search Path Element

NVIDIA GPU Display Driver for Windows contains a vulnerability in nvidia-smi where an uncontrolled DLL loading path may lead to arbitrary code execution, denial of service, information disclosure, and data tampering...

CVE-2021-1091: Improper Link Resolution Before File Access

NVIDIA GPU Display driver for Windows contains a vulnerability where an unprivileged user can create a file hard link that causes the driver to overwrite a file that requires elevated privilege to modify, which could lead to data loss or denial of service...

CVE-2021-1094: Out-of-bounds Read

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape where an out of bounds array access may lead to denial of service or information disclosure...

CVE-2021-1090: Buffer Copy without Checking Size of Input

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for control calls where the software reads or writes to a buffer by using an index or pointer that references a memory location after the end of the buffer, which may lead to dat...

CVE-2021-1095: NULL Pointer Dereference

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer nvlddmkm.sys handlers for all control calls with embedded parameters where dereferencing an untrusted pointer may lead to denial of service...

CVE-2021-1093: Improper Resource Shutdown or Release

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary, and may lead to denial of...