A vulnerability, which was classified as critical, has been found in NVIDIA NVFlash, NVUFlash Tool, GPUModeSwitch Tool and Kernel Mode Driver (Hardware Driver Software) (affected version unknown). This issue affects an unknown functionality. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) contains a vulnerability in which authenticated users with administrative privileges can gain access to device memory and registers of other devices not managed by NVIDIA, which may lead to escalation of privileges, information disclosure, or denial of service.

The weakness was disclosed 11/18/2019. The identification of this vulnerability is CVE-2019-5688 since 01/07/2019. An attack has to be approached locally. The successful exploitation needs a simple authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

Upgrading eliminates this vulnerability.

Productinfo

Type

• Hardware Driver Software

Vendor

• NVIDIA

Name

• GPUModeSwitch Tool
• Kernel Mode Driver
• NVFlash
• NVUFlash Tool

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion