NVIDIA Windows GPU Display Driver, DirectX 10 user-mode driver: A crafted pixel shader writes into unallocated memory

Impact

A crafted pixel shader writes into unallocated memory in the user-mode driver. Because shaders are attacker-authored content in any remote-rendering, VDI or cloud-gaming path, this is a code-execution primitive reachable from whatever feeds you shaders.

Who can reach it

Anyone who can submit a shader to the host - a tenant VM in a vGPU/vSGA setup, a remote desktop session, or a local user.

What to do

Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.

References

Related entries

• NVIDIA Windows GPU Display Driver, 3D Vision stereo service: A privileged NVIDIA service opens files without checkingCVE-2019-5665 · NVIDIA Windows GPU Display Driver, 3D Vision stereo serviceHigh
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): The context-creation DDI uses an untrusted array indexCVE-2019-5666 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): NULL dereference in the page-table DDI handler, reachable locallyCVE-2019-5667 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): NULL dereference in the virtual command submission handlerCVE-2019-5668 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Out-of-bounds kernel buffer access through the escape handlerCVE-2019-5669 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Same escape-handler length bug but with information disclosureCVE-2019-5670 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High