NVIDIA Windows GPU Display Driver Kernel Mode Layer access control

Summaryinfo

A vulnerability labeled as problematic has been found in NVIDIA Windows GPU Display Driver. This affects an unknown part of the component Kernel Mode Layer. The manipulation results in access control. This vulnerability is cataloged as CVE-2018-6252. The attack must be initiated from a local position. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in NVIDIA Windows GPU Display Driver (Hardware Driver Software) (the affected version unknown). Affected is an unknown part of the component Kernel Mode Layer. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on availability. CVE summarizes:

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer handler for DxgkDdiEscape where the software allows an actor access to restricted functionality that is unnecessary to production usage, and which may result in denial of service.

The bug was discovered 03/28/2018. The weakness was shared 04/02/2018 (Website). The advisory is shared for download at nvidia.custhelp.com. This vulnerability is traded as CVE-2018-6252 since 01/25/2018. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability was handled as a non-public zero-day exploit for at least 5 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 108852 (Amazon Linux AMI : nvidia (ALAS-2018-991)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Amazon Linux Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 351222 (Amazon Linux Security Advisory for nvidia: ALAS-2018-991).

Upgrading eliminates this vulnerability. A possible mitigation has been published 3 days after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (108852). The entries VDB-115519, VDB-115520, VDB-115521 and VDB-115522 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Hardware Driver Software

Vendor

• NVIDIA

Name

• Windows GPU Display Driver

License

• commercial

Website

• Vendor: https://www.nvidia.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion