NVIDIA GPU driver / GRID vGPU and vSGA - host memory mapping path: MULTI-TENANT ISOLATION: the host memory mapping path

Impact

MULTI-TENANT ISOLATION: the host memory mapping path did not restrict access to third-party device I/O memory, giving a guest privilege escalation on the host. Scored 10.0. Included here despite its age because it is the archetype of the vGPU escape class and because GRID/vSGA stacks this old are still found running in long-lived VDI estates that were never in anyone's patch programme.

Who can reach it

A guest on a GRID vGPU or vSGA host. The mapping path is reachable from the guest driver.

What to do

Upgrade the host driver to R346 346.87 / R352 352.41 (Linux) or R352 352.46 (GRID vGPU and vSGA) or, realistically, to a supported branch - anything on these versions is a decade out of support. Cost: full hypervisor host drain. If you find this in your estate the finding is not the CVE, it is that you have an unmanaged vGPU host.

References