Log in Start free

Vulnerability · Published Dec 30, 2022 · Assigned by nvidia

CVE-2022-42260

High 7.8

In plain English

A high-severity security flaw in vGPU software (guest driver) - Linux, NVIDIA Cloud Gaming (guest driver) from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 83.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nvidia-graphics-drivers510.108.03-1DEBIAN-CVE-2022-42260
Debian:13nvidia-graphics-drivers510.108.03-1DEBIAN-CVE-2022-42260
Debian:14nvidia-graphics-drivers510.108.03-1DEBIAN-CVE-2022-42260
Debian:12nvidia-graphics-drivers-tesla510.108.03-1DEBIAN-CVE-2022-42260
Debian:12nvidia-graphics-drivers-tesla-470470.161.03-1DEBIAN-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-418-serverno fix listedUBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-430no fix listedUBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-440no fix listedUBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-450no fix listedUBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-450-server450.216.04-0ubuntu0.22.04.1UBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-455no fix listedUBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-460no fix listedUBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-470470.161.03-0ubuntu0.22.04.1UBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-470-server470.161.03-0ubuntu0.22.04.1UBUNTU-CVE-2022-42260
Ubuntu:22.04:LTSnvidia-graphics-drivers-510510.108.03-0ubuntu0.22.04.1UBUNTU-CVE-2022-42260

Affected products (as reported)

VendorProductVersions
NVIDIA vGPU software (guest driver) - Linux, NVIDIA Cloud Gaming (guest driver) All versions prior to and including 14.2, 13.4, and 11.9, and all versions prior to the November 2022 release

Weakness: CWE-281 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References