NVIDIA GPU Display Driver, DirectX and OpenGL user-mode drivers: A crafted pixel shader drives the user-mode driver

Impact

A crafted pixel shader drives the user-mode driver into infinite recursion and kills the rendering process or the session. On a shared render farm or VDI host, one tenant's shader takes out their own session and can pin a core doing it.

Who can reach it

Anyone who can submit shaders - remote session users, tenant VMs, or local processes.

What to do

Install the fixed GPU Display Driver branch on both Windows and Linux nodes. The kernel component (nvlddmkm.sys / nvidia.ko) cannot be hot-swapped under load, so this is a node drain and reboot per host; restart the container runtime afterwards so mounted driver libraries match the kernel module. No VBIOS or BMC flash.

References

Related entries

• NVIDIA GPU Display Driver, GPU hardware performance counters: GPU performance counters are readable by any local userCVE-2018-6260 · NVIDIA GPU Display Driver, GPU hardware performance countersMedium
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Resource leak in the escape handlerCVE-2019-5671 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Out-of-bounds read in the DeviceIoControl handlerCVE-2019-5677 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): The escape handler relies on invariants that are not guaranteed, soCVE-2019-5686 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
• NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Uninitialised pointer use in nvlddmkm.sys. Local denial of serviceCVE-2019-5693 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
• NVIDIA vGPU Manager (vGPU plugin): A guest VM hands the vGPU Manager a wrongly sized buffer and drives the host into anCVE-2019-5696 · NVIDIA vGPU Manager (vGPU plugin)Medium