NVIDIA Windows GPU Display Driver, DirectX 11 user-mode driver (nvwgf2um.dll): Crafted shader triggers an out-of-bounds

Impact

Crafted shader triggers an out-of-bounds access in the DX11 user-mode driver, this time rated code-execution capable. Anywhere untrusted shaders reach the GPU - VDI, cloud gaming, remote rendering - treat it as RCE at the session's privilege level.

Who can reach it

Anyone who can submit shaders to the host, including from a guest VM or remote session.

What to do

Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.

References

Related entries

• NVIDIA Windows GPU Display Driver, DirectX 11 user-mode driver (nvwgf2um.dll): A crafted shader causes an out-of-boundsCVE-2020-5965 · NVIDIA Windows GPU Display Driver, DirectX 11 user-mode driver (nvwgf2um.dll)Medium
• NVIDIA vGPU Manager (vGPU plugin): Use-after-free while releasing resources in the vGPU plugin, rated code-executionCVE-2020-5984 · NVIDIA vGPU Manager (vGPU plugin)High
• NVIDIA vGPU Manager (vGPU plugin): Parameters stay writable by the guest after the plugin has validated them - aCVE-2020-5987 · NVIDIA vGPU Manager (vGPU plugin)High
• NVIDIA CUDA Toolkit, nvJPEG library: Out-of-bounds read/write in nvJPEG while decoding an image, rated code-executionCVE-2020-5991 · NVIDIA CUDA Toolkit, nvJPEG libraryHigh
• NVIDIA GPU Display Driver (Windows nvlddmkm.sys + Linux nvidia.ko): User-mode clients can reach legacy privileged APIsCVE-2021-1052 · NVIDIA GPU Display Driver (Windows nvlddmkm.sys + Linux nvidia.ko)High
• NVIDIA vGPU Manager (vGPU plugin): The vGPU plugin lets guests allocate resources they are not authorised to holdCVE-2021-1057 · NVIDIA vGPU Manager (vGPU plugin)High