So it turns out that Nvidia has run into some security problems of their own with the recent cache of GPU driver updates.
And amid the current swarm of controversy over large-impact data breaches like the recent Capital One hack, this isn’t a good thing to mess up. Thankfully, it appears the GPU manufacturer has gotten things correct and managed to pack multiple fixes for several different classes of vulnerabilities into one update.
Most of the issues are direct issues within the Windows GPU Display Driver, or the component that controls video rendering at the base level within Nvidia’s software. A couple of issues with maliciously-crafted resources could allow users to execute malicious code through DirectX. And some other issues involve kernel mode aspects of the software that could allow an attacker to engage in denial of service attacks, shutting down the target machine.
As for what platforms are affected, certain product lines within the Tesla, Quadro and GeForce GPU lines are affected.
For Quadro and NVS hardware, All R390 versions prior to 392.56 are vulnerable to some exploits, as well as All R400 versions. Finally All R430 versions prior to 431.70 have some level of exposure too. All GeForce GPUs running All R430 versions prior to 431.60 are exposed to these vulnerabilities. And with Tesla models, All R418 versions are vulnerable.
The software security issues fixed by NVIDIA as part of the August 2019 security update are listed below, together with full descriptions and the CVSS V3 base scores assigned by the company to each of them.
| CVE | Description | Base Score |
|---|---|---|
| CVE‑2019‑5683 | NVIDIA Windows GPU Display Driver contains a vulnerability in the user mode video driver trace logger component. When an attacker has access to the system and creates a hard link, the software does not check for hard link attacks. This behavior may lead to code execution, denial of service, or escalation of privileges. | 8.8 |
| CVE‑2019‑5684 | NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution. | 7.8 |
| CVE‑2019‑5685 | NVIDIA Windows GPU Display Driver contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access to a shader local temporary array, which may lead to denial of service or code execution. | 7.8 |
| CVE‑2019‑5686 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which the software uses an API function or data structure in a way that relies on properties that are not always guaranteed to be valid, which may lead to denial of service. | 5.6 |
| CVE‑2019‑5687 | NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which an incorrect use of default permissions for an object exposes it to an unintended actor, which may lead to information disclosure or denial of service. | 5.2 |
You can download the latest patched drivers here. It’s also highly recommended to use DDU to remove the entirety of the previous drivers and do a clean install of the updated versions if possible.
