Nvidia has released a security update fixing three high severity security issues. These were present in the NVIDIA GPU display driver and the attackers had to have local user access to exploit the flaws. The vulnerabilities included denial of service, escalation of privileges and even information disclosure on any unpatched GPU drivers.
The drivers to apply the security updates can be downloaded from the Nvidia driver downloads page.
The attackers could render affected computers unusable while having the ability to run commands or code on the system. This could be achieved by abusing unpatched code vulnerabilities, leading to a denial of service. They could also elevate user privileges, gaining unauthori
The issues were given the id’s of CVE‑2019‑5675, CVE‑2019‑5676, and CVE‑2019‑5677. The risk assessment was done on the basis of CVSS V3 standards. Here are the software issues patched-
Nvidia also mentioned;
The NVIDIA risk assessment is based on an average of risk across a diverse set of installed systems and may not represent the true risk of your local installation. NVIDIA recommends consulting a security or IT professional to evaluate the risk to your specific configuration.
If the GPU driver is installed on Windows 7, Microsoft KB2533623 must be installed as a prerequisite to addressing this CVE. This CVE does not affect driver packages provided by your hardware vendor and applies only to driver packages that are downloaded from the NVIDIA Driver Downloads public web page.
The CVE‑2019‑5676 DLL search order hijacking flaw was reported by Kushal Arvind Shah of Fortinet’s FortiGuard Labs, Łukasz ‘zaeek’, Yasin Soliman, Marius Mihai, and Stefan Kanthak. This flaw could have lead to DLL preloading attacks AKA binary planting.
Further Reading: