380 matches found
NVIDIA Driver - No Bounds Checking in Escape 0x7000170
NVIDIA Driver - No Bounds Checking in Escape 0x7000170 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=936 The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writin...
NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9
NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=947 The escape handler for 0x10000e9 lacks bounds checks, and passes a user specified size as the size to memcpy, resulting in a stack buffer overflow: bool...
NVIDIA Driver - Stack Buffer Overflow in Escape 0x7000014
NVIDIA Driver - Stack Buffer Overflow in Escape 0x7000014 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=946 There is a missing bounds check in inner loop of the escape handler for 0x7000014 that leads to a stack buffer overflow: ... for DWORD i = 0; numdata; ++i ... // size is...
NVIDIA Driver - Unchecked Write to User-Provided Pointer in Escape 0x600000D
NVIDIA Driver - Unchecked Write to User-Provided Pointer in Escape 0x600000D Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=911 The DxgkDdiEscape handler for 0x600000D passes an unchecked user provided pointer as the destination for a memcpy call. This leads to kernel memory...
NVIDIA Driver - Missing Bounds Check in Escape 0x100009a
NVIDIA Driver - Missing Bounds Check in Escape 0x100009a Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942 The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks: case 0x100009A: ... size0 = escapedata-size1; ... size1 = 2 - escapedata-unknown size2;...
NVIDIA Driver - No Bounds Checking in Escape 0x7000194
NVIDIA Driver - No Bounds Checking in Escape 0x7000194 Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=895 The DxgkDdiEscape handler for 0x7000194 doesn't do bounds checking with the user provided lengths it receives. When these lengths are passed to memcpy, overreads and memory...
NVIDIA Driver - NvStreamKms PsSetCreateProcessNotifyRoutineEx Local Stack Buffer Overflow Callback Local Privilege Escalation
NVIDIA Driver - NvStreamKms PsSetCreateProcessNotifyRoutineEx Local Stack Buffer Overflow Callback Local Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=918 The NvStreamKms.sys driver calls PsSetCreateProcessNotifyRoutineEx to set up a process creation...
NVIDIA Driver - Stack Buffer Overflow in Escape 0x10000e9
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=947 The escape handler for 0x10000e9 lacks bounds checks, and passes a user specified size as the size to memcpy, resulting in a stack buffer overflow: bool escape10000e9NvMiniportDeviceContext a1, Escape10000e9 escape ... LOBYTEa9...
NVIDIA Driver - UVMLiteController ioctl Handling Unchecked Input/Output Lengths Privilege Escalation
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=880 The \.\UVMLiteController device is created by the nvlddmkm.sys driver, and can be opened by any user. The driver handles various control codes for this device, but there is no validation for the input/output buffer and their...
NVIDIA Driver - NvStreamKms 'PsSetCreateProcessNotifyRoutineEx Local Stack Buffer Overflow Callback / Local Privilege Escalation
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=918 The NvStreamKms.sys driver calls PsSetCreateProcessNotifyRoutineEx to set up a process creation notification routine. In this particular routine, if cur-imagenamescount 0 // info is the PPSCREATENOTIFYINFO that is passed to the...
NVIDIA Driver - Missing Bounds Check in Escape 0x70000d5
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=944 The DxgkDdiEscape handler for 0x70000d5 lacks bounds checks: ... if gsavedsize escape-size = gsavedsize; if unsigned intgsavedsize 0 do v5 = v2++; escape-datav5 = globalarrayv5 + 77; while v2 size 0 do ii = i++; globalarrayii +...
NVIDIA Driver - No Bounds Checking in Escape 0x7000170
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=936 The DxgkDdiEscape handler for 0x7000170 lacks proper bounds checks for the variable size input escape data, and relies on a user provided size as the upper bound for writing output. Crashing context with PoC Win 10 x64 with...
NVIDIA Driver - Incorrect Bounds Check in Escape 0x70001b2
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=940 The DxgkDdiEscape handler for 0x70001b2 doesn't do proper bounds checks for its variable size input. void sub8C4304... ... // escape-size is controlled by the user. if escape-size size; memcpyescape-data, v31, 28i64 size;...
NVIDIA Driver - Missing Bounds Check in Escape 0x100009a
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=942 The DxgkDdiEscape handler for escape 0x100009a lacks proper bounds checks: case 0x100009A: ... size0 = escapedata-size1; ... size1 = 2 - escapedata-unknown size2; ... totalsize = size0 size1 size2; ... if totalsize 0x10...
NVIDIA Driver - Escape 0x100010b Missing Bounds Check
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=927 The DxgkDdiEscape handler for escape code 0x100010b looks like: char escape100010bNvMiniportDeviceContext miniportcontext, HANDLE handle, unsigned int idx PVOID Object; if !handle dodebugthingo; Object = PVOID...
NVIDIA Driver - No Bounds Checking in Escape 0x7000194
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=895 The DxgkDdiEscape handler for 0x7000194 doesn't do bounds checking with the user provided lengths it receives. When these lengths are passed to memcpy, overreads and memory corruption can occur. void fastcall...
NVIDIA Driver - Unchecked Write to User-Provided Pointer in Escape 0x700010d
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=894 The DxgkDdiEscape handler for 0x700010d accepts a user provided pointer as the destination for a memcpy call, without doing any checks on said pointer. void fastcall escape700010DNvMiniportDeviceContext ctx, NvEscapeData escape...
The vulnerability of the Android operating system, which allows a hacker to increase their privileges
The vulnerability of NVIDIA’s Android operating system driver is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially created application...
Android on Nexus NVIDIA Privilege Gain Vulnerability
Android on Nexus 9 is an open source operating system running on the Nexus 9 Tablet PC and based on Linux, jointly developed by Google and the Open Handset Alliance OHA.The NVIDIA media driver is a multimedia driver that is used in the Nexus 9. A privilege acquisition vulnerability exists in the...
Android NVIDIA Driver Elevation of Privilege Vulnerability
Android on Nexus 9 is a Linux-based open source operating system for the Nexus 9 Tablet PC developed by Google and the Open Handset Alliance OHA.NVIDIA video driver is a component of the NVIDIA video card driver. An elevation of privilege vulnerability exists in the NVIDIA video driver in version...