NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Hard-link attack: an unprivileged user makes the driver overwrite
CVSS 7.1CVE-2021-1091NVIDIA / GPU stackcurated
Impact
Hard-link attack: an unprivileged user makes the driver overwrite a file that needs elevated privilege to modify. Arbitrary privileged file overwrite, which is a well-trodden route to SYSTEM.
Who can reach it
Any local unprivileged user on a Windows GPU host.
What to do
Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.
References
Related entries
- NVIDIA Windows GPU Display Driver (nvlddmkm.sys): The driver loads Windows system DLLs without validating pathCVE-2019-5676 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
- NVIDIA Windows GPU Display Driver (nvlddmkm.sys): NULL dereference reachable through private IOCTLs, with NVIDIA notingCVE-2021-1115 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
- NVIDIA Windows GPU Display Driver (nvlddmkm.sys): The escape handler exposes functionality that should neverCVE-2018-6252 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
- NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Resource leak in the escape handlerCVE-2019-5671 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
- NVIDIA Windows GPU Display Driver (nvlddmkm.sys): Out-of-bounds read in the DeviceIoControl handlerCVE-2019-5677 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
- NVIDIA Windows GPU Display Driver (nvlddmkm.sys): The escape handler relies on invariants that are not guaranteed, soCVE-2019-5686 · NVIDIA Windows GPU Display Driver (nvlddmkm.sys)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.