Vulnerabilities > CVE-2017-6266 - Unspecified vulnerability in Nvidia GPU Driver
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
COMPLETE Summary
NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where improper access controls could allow unprivileged users to cause a denial of service.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 1 | |
OS | 1 |
Nessus
NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-3461-1.NASL description It was discovered that the NVIDIA graphics drivers contained flaws in the kernel mode layer. A local attacker could use these issues to cause a denial of service or potentially escalate their privileges on the system. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 104122 published 2017-10-24 reporter Ubuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/104122 title Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : nvidia-graphics-drivers-384 vulnerabilities (USN-3461-1) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-3461-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(104122); script_version("3.9"); script_cvs_date("Date: 2019/09/18 12:31:47"); script_cve_id("CVE-2017-6257", "CVE-2017-6259", "CVE-2017-6266", "CVE-2017-6267", "CVE-2017-6272"); script_xref(name:"USN", value:"3461-1"); script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : nvidia-graphics-drivers-384 vulnerabilities (USN-3461-1)"); script_summary(english:"Checks dpkg output for updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Ubuntu host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "It was discovered that the NVIDIA graphics drivers contained flaws in the kernel mode layer. A local attacker could use these issues to cause a denial of service or potentially escalate their privileges on the system. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/3461-1/" ); script_set_attribute( attribute:"solution", value:"Update the affected nvidia-384 package." ); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nvidia-384"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:17.04"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/07/28"); script_set_attribute(attribute:"patch_publication_date", value:"2017/10/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/24"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(14\.04|16\.04|17\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04 / 16.04 / 17.04", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"14.04", pkgname:"nvidia-384", pkgver:"384.90-0ubuntu0.14.04.1")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nvidia-384", pkgver:"384.90-0ubuntu0.16.04.1")) flag++; if (ubuntu_check(osver:"17.04", pkgname:"nvidia-384", pkgver:"384.90-0ubuntu0.17.04.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nvidia-384"); }
NASL family Windows NASL id NVIDIA_WIN_CVE_2017_6272.NASL description NVIDIA GPU display driver vulnerabilities may lead to denial of service or possible escalation of privileges. To exploit these vulnerabilities an attacker would send a malicious request to an affected application or interact with an affected application. If successfully exploited, these vulnerabilities would allow an attacker to cause a denial of service condition or elevated privileges. last seen 2020-06-01 modified 2020-06-02 plugin id 103458 published 2017-09-25 reporter This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/103458 title NVIDIA Windows GPU Display Driver 375.x / 384.x < 385.08 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(103458); script_version("1.7"); script_cvs_date("Date: 2019/11/12"); script_cve_id( "CVE-2017-6266", "CVE-2017-6267", "CVE-2017-6268", "CVE-2017-6269", "CVE-2017-6270", "CVE-2017-6271", "CVE-2017-6272", "CVE-2017-6277" ); script_name(english:"NVIDIA Windows GPU Display Driver 375.x / 384.x < 385.08 Multiple Vulnerabilities"); script_summary(english:"Checks the driver version."); script_set_attribute(attribute:"synopsis", value: "A display driver installed on the remote Windows host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "NVIDIA GPU display driver vulnerabilities may lead to denial of service or possible escalation of privileges. To exploit these vulnerabilities an attacker would send a malicious request to an affected application or interact with an affected application. If successfully exploited, these vulnerabilities would allow an attacker to cause a denial of service condition or elevated privileges."); script_set_attribute(attribute:"see_also", value:"https://nvidia.custhelp.com/app/answers/detail/a_id/4544"); script_set_attribute(attribute:"solution", value: "Upgrade the NVIDIA graphics driver to version 385.69 or later in accordance with the vendor advisory."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-6277"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"vuln_publication_date", value:"2017/09/21"); script_set_attribute(attribute:"patch_publication_date", value:"2017/09/21"); script_set_attribute(attribute:"plugin_publication_date", value:"2017/09/25"); script_set_attribute(attribute:"potential_vulnerability", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:nvidia:gpu_driver"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("wmi_enum_display_drivers.nbin"); script_require_keys("WMI/DisplayDrivers/NVIDIA", "Settings/ParanoidReport"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); if (report_paranoia < 2) audit(AUDIT_PARANOID); kb_base = 'WMI/DisplayDrivers/'; # double check in case optimization is disabled kbs = get_kb_list(kb_base + '*/Name'); if (isnull(kbs)) exit(0, 'No display drivers were found.'); report = ''; foreach kb (keys(kbs)) { name = kbs[kb]; # only check NVIDIA drivers if ("NVIDIA" >!< name) continue; nvidia_found = TRUE; id = kb - kb_base - '/Name'; version = get_kb_item_or_exit(kb_base + id + '/Version'); driver_date = get_kb_item_or_exit(kb_base + id + '/DriverDate'); disp_driver_date = driver_date; # convert to something we can pass to ver_compare (YYYY.MM.DD) driver_date = split(driver_date, sep:'/', keep:FALSE); driver_date = driver_date[2] + '.' + driver_date[0] + '.' + driver_date[1]; fix = ''; note = ''; # R375 Branch includes 375.x, 376.x, 377.x - http://www.nvidia.com/object/quadro-branch-history-table.html # R384 Branch includes 385.x if (version =~ "^(37[567]|38[45])\." && ver_compare(ver:version, fix:"385.69", strict:FALSE) == -1) { fix = '385.69'; note = '\n\nGeForce Series includes GFE 3.9.0.61'; } if (!empty(fix)) { order = make_list('Device name','Driver version','Driver date','Fixed version'); report = make_array( order[0],name, order[1],version, order[2],disp_driver_date, order[3],fix ); report = report_items_str(report_items:report, ordered_fields:order); break; } } if (!nvidia_found) exit(0, 'No NVIDIA display drivers were found.'); if (!empty(report)) security_report_v4(severity:SECURITY_HOLE, port:0, extra:report+note); else exit(0, "No vulnerable NVIDIA display drivers were found.");
NASL family Misc. NASL id NVIDIA_UNIX_CVE_2017_6272.NASL description NVIDIA GPU display driver vulnerabilities may lead to denial of service or possible escalation of privileges. To exploit these vulnerabilities an attacker would send a malicious request to an affected application or interact with an affected application. If successfully exploited, these vulnerabilities would allow an attacker to cause a denial of service condition or elevated privileges. last seen 2020-06-01 modified 2020-06-02 plugin id 103457 published 2017-09-25 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/103457 title NVIDIA Linux GPU Display Driver 375.x < 375.88 / 384.x < 384.90 Multiple Vulnerabilities