NVIDIA GPU Display Driver for Windows, installer: A race between the installer's integrity check and execution lets
Impact
A race between the installer's integrity check and execution lets an unprivileged local user swap in a malicious file and get it run by an administrator's install. The window is short, which is a mitigation and not a fix - driver rollouts are scheduled and repeatable, so an attacker sitting on the box knows exactly when to try.
Who can reach it
An unprivileged local user present on the host while an administrator runs the driver installer.
What to do
Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.
References
Related entries
- NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Use of a dangling pointer in the escape handler, rated code-executionCVE-2021-1075 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)High
- NVIDIA vGPU Manager (vGPU plugin): The guest can write to a shared memory location after the host has validated itsCVE-2021-1085 · NVIDIA vGPU Manager (vGPU plugin)High
- DGX H100 BMC (IPMI): PrivescCVE-2023-31008 · DGX H100 BMC (IPMI)High
- GPU Display Driver (Windows): Arbitrary code exec via uncontrolled search pathCVE-2023-31016 · GPU Display Driver (Windows)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2024-38552 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2024-46811 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.