NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Hard-link attack on the user-mode video driver's trace logger

Impact

Hard-link attack on the user-mode video driver's trace logger: a privileged component writes where an unprivileged user points it. Arbitrary file overwrite as SYSTEM.

Who can reach it

Any local unprivileged user on the Windows host.

What to do

Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.

References