By 
NVIDIA has announced a security news for the display driver of NVIDIA GPU, to state various High severity flaws influencing NVS, Quadro, GeForce, and Tesla products. The GPU maker stated that a total number of eight security flaws were mentioned in this round of fixes, among them five of which have a CVSS 8.8 score. Exploitation of these vulnerabilities could chance to code implementation, Denial of Service of advantages on the impacted systems.
The primary vulnerabilities were detected in the 3D vision component of the GPU display driver as CVE‑2019‑5665 trailed. The vulnerability impacts the stereo service software, which does not require for hard links when open source file. Another issue impacts as CVE‑2019‑5666, the kernel mode layer, nvlddmkm.sys generate context command DDI DxgkDdiCreateContext. Inaccurate confirmation of non-trusted input or index fails to make sure the index remarks a confirm location within the array.
CVE‑2019‑5667 is a flaw in the kernel mode layer, nvlddmkm.sys handler for DxgkDdiSetRootPageTable, while CVE‑2019‑5668 influences the kernel mode layer, nvlddmkm.sys handler for DxgkDdiSubmitCommandVirtual. In both situations, the application deferences a mark that, instead of being effectual, is NULL.
The fifth High severity vulnerability is CVE‑2019‑5669, existing in the kernel mode layer DxgkDdiEscape handler. When benefiting a consecutive function to read from or write to a buffer, the software employs an inaccurate length value, therefore admin accessing memory outside of the buffer’s bounds.
Another important vulnerability NVIDIA addressed in this round of patches is CVE‑2019‑5670, which also impacts the kernel mode layer handler for DxgkDdiEscape and causes the software to access memory outside of its buffer. This could lead to denial of service, escalation of privileges, code execution or information disclosure.
CVE‑2019‑5671 is an another vulnerability, a Denial of Service bug in in the kernel mode layer, nvlddmkm.sys DxgkDdiEscape handler, where the software does not announce a resource after its valid lifetime has lasted.
The final vulnerability is CVE‑2018‑6260, where processing of application data on the GPU is approachable through a side channel revealed by the GPU execution counters. Exploitation of this flaw needs local admin access, however the bug also influences FreeBSD, Linux, and Solaris.
