CVE-2016-7391
HighSummary
The NVIDIA GPU driver for Quadro, NVS, and GeForce products contains a vulnerability in the kernel mode layer that allows writing to kernel memory due to a missing array bounds check. This can lead to denial of service or potential privilege escalation.
Risk Assessment
The organization may be exposed to attacks that could result in system crashes or unauthorized elevation of privileges by users.
Recommendation
It is recommended to update the GPU driver to version 342.00 or later for R340 and 375.63 or later for R375 to mitigate this vulnerability.
Other vulnerabilities in NVIDIA Windows GPU Display Driver (nvlddmkm.sys)
See all- CVE-2017-0343High
All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) where a user can trigger a race condition due to lack of synchronization in two functions.
- CVE-2016-8818High
All versions of the NVIDIA Windows GPU Display driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape, where a pointer passed from a user to the driver is used without validation. This can lead to denial of service or potential escalation of privileges.
- CVE-2016-8811High
The NVIDIA GPU driver for Quadro, NVS, and GeForce products contains a vulnerability in the kernel mode layer (nvlddmkm.sys) that does not validate the size of an input buffer for DxgDdiEscape ID 0x7000170. This can lead to denial of service or potential escalation of privileges.
- CVE-2016-8809High
The NVIDIA GPU driver for Quadro, NVS, and GeForce products contains a vulnerability in the kernel mode layer that does not validate the size of an input buffer. This may lead to denial of service or potential escalation of privileges.
- CVE-2016-8807High
The NVIDIA GPU driver for Quadro, NVS, and GeForce products before R342.00 and R375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) that can lead to a stack buffer overflow. A value passed from a user to the driver is used without validation as the size input to memcpy().
- CVE-2016-7388High
The NVIDIA GPU driver for Quadro, NVS, and GeForce products contains a vulnerability in the kernel mode layer (nvlddmkm.sys) that may lead to denial of service or potential privilege escalation due to a NULL pointer dereference caused by invalid user input.
- CVE-2016-7387High
The NVIDIA GPU driver for Quadro, NVS, and GeForce products contains a vulnerability in the kernel mode layer that allows an unvalidated value to be used as an index to an internal array. This can lead to denial of service or potential privilege escalation.
- CVE-2016-7385High
The NVIDIA GPU driver for Quadro, NVS, and GeForce products before version 342.00 and R375 before version 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys). A value passed from a user to the driver is used without validation as the index to an internal array, potentially leading to denial of service or privilege escalation.
- CVE-2016-7384High
The NVIDIA GPU driver for Quadro, NVS, and GeForce products contains a vulnerability in the kernel mode layer (nvlddmkm.sys) that may lead to denial of service or potential escalation of privileges due to unchecked input/output lengths in UVMLiteController Device IO Control handling.
Original NVD description (English source)
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x100010b where a missing array bounds check can allow a user to write to kernel memory, leading to denial of service or potential escalation of privileges.