NVIDIA vGPU Manager (vGPU plugin): Information retrievable by a guest that defeats ASLR on the host side. On its own it

Impact

Information retrievable by a guest that defeats ASLR on the host side. On its own it does nothing; combined with any of the memory-corruption bugs in the same bulletin it is what makes a guest-to-host escape reliable instead of a coin flip. vGPU 12.x before 12.2, 11.x before 11.4, 8.x before 8.7.

Who can reach it

Any unprivileged user inside a guest VM with a vGPU.

What to do

Upgrade the vGPU Manager on the hypervisor host to the fixed vGPU release. The host component is a kernel module inside the hypervisor, so this is a full node drain: evacuate or power off every tenant VM on the host, upgrade, reboot the host. Guest drivers must be kept within the supported version skew and updated per VM (guest reboot). No VBIOS flash, but expect a maintenance window per host and a matching hypervisor-vendor package (VMware/Citrix/KVM/Nutanix builds ship separately).

References

Related entries

• NVIDIA vGPU Manager (vGPU plugin): NULL dereference in the vGPU plugin, guest-reachableCVE-2021-1101 · NVIDIA vGPU Manager (vGPU plugin)Medium
• NVIDIA vGPU Manager (vGPU plugin): Guest input drives the vGPU plugin into a floating-point exception and takes theCVE-2021-1102 · NVIDIA vGPU Manager (vGPU plugin)Medium
• NVIDIA vGPU Manager (vGPU plugin): Guest-reachable NULL dereference in the vGPU plugin causing denial of service acrossCVE-2021-1122 · NVIDIA vGPU Manager (vGPU plugin)Medium
• NVIDIA vGPU Manager (vGPU plugin): A guest can deadlock the vGPU plugin. A hung plugin does not crash-and-restartCVE-2021-1123 · NVIDIA vGPU Manager (vGPU plugin)Medium
• NVIDIA vGPU Manager (vGPU plugin): An index value from the guest is not validated by the vGPU plugin, letting oneCVE-2019-5698 · NVIDIA vGPU Manager (vGPU plugin)Medium
• NVIDIA vGPU Manager (vGPU plugin): Another guest-reachable NULL dereference in the vGPU plugin causing denial ofCVE-2021-1103 · NVIDIA vGPU Manager (vGPU plugin)Medium