NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Any local account on a Windows GPU host can call the driver's escape

Impact

Any local account on a Windows GPU host can call the driver's escape path and hit a NULL dereference. Best case the box bugchecks and you lose every job on it; NVIDIA also rates privilege escalation as possible, which on a kernel driver means SYSTEM.

Who can reach it

Any local user or service account on the host, including anything running inside a Windows container that has the GPU mapped in.

What to do

Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.

References

Related entries

• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Out-of-bounds kernel read/write from an unprivileged escape callCVE-2018-6248 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Same class as the other early-2018 escape bugs: an unprivilegedCVE-2018-6250 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): A local user gets elevated enough to rewrite display configurationCVE-2021-1051 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): The context-creation DDI uses an untrusted array indexCVE-2019-5666 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): NULL dereference in the page-table DDI handler, reachable locallyCVE-2019-5667 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): NULL dereference in the virtual command submission handlerCVE-2019-5668 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High