These flaws are strikingly similar to high-severity vulnerabilities reported by Nvidia in May 2019, which also existed in the DxgkDdiEscape interface within the kernel mode layer of the driver. All of these issues could enable escalation of privileges or DoS. These issues include the handler not validating the size of an input buffer (CVE‑2019‑5690), derefencing a NULL pointer (CVE‑2019‑5691) and using untrusted input when calculating an array index (CVE‑2019‑5692). Kernel mode is generally reserved for the lowest-level, most trusted functions of the operating system in this case, the layer handler (nvlddmkm.sys) for the DxgkDdiEscape interface within the kernel mode has an array of glitches. The driver has three high-severity flaws (CVE‑2019‑5690, CVE‑2019‑5691, CVE‑2019‑5692), which all stem from the kernel mode layer handler component of the driver, Nvidia said on Wednesday. This is the software component that enables the device’s operating system and programs to use its high-level graphics hardware. The majority of the high-severity flaws are in the Windows GPU Display Driver, Nvidia’s graphics driver used in devices targeted to enthusiast gamers. The flaws can be exploited to launch an array of malicious attacks – from denial-of-service efforts (DoS) to escalation of privileges. Nvidia has issued fixes for high-severity flaws in two popular gaming products, including its graphics driver for Windows and GeForce Experience.
0 kommentar(er)
