NVIDIA Windows GPU Display Driver (nvlddmkm.sys): NULL dereference in the virtual command submission handler

CVSS 7.8CVE-2019-5668NVIDIA / GPU stackcurated

Impact

NULL dereference in the virtual command submission handler. Any local process that can submit work can bugcheck the node.

Who can reach it

Any local user with GPU device access.

What to do

Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.

References

http://support.lenovo.com/us/en/solutions/LEN-26250 https://nvd.nist.gov/vuln/detail/CVE-2019-5668

Related entries

NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Out-of-bounds kernel buffer access through the escape handlerCVE-2019-5669 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Same escape-handler length bug but with information disclosureCVE-2019-5670 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Unsynchronized shared state (static variables across threads)CVE-2019-5675 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Hard-link attack on the user-mode video driver's trace loggerCVE-2019-5683 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
NVIDIA Windows GPU Display Driver (nvlddmkm.sys): The escape handler does not validate input buffer sizeCVE-2019-5690 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
NVIDIA Windows GPU Display Driver (nvlddmkm.sys): NULL dereference in the escape handlerCVE-2019-5691 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.