NVIDIA Fixes High-Risk GPU Driver Vulnerabilities That Allow Code Execution and Data Theft

[AleksandarK]

NVIDIA has released urgent security patches addressing eight vulnerabilities in its GPU drivers and virtual GPU software that affect both Windows and Linux systems. The January 16 update targets multiple security flaws that could enable attackers with local access to execute malicious code, steal data, or crash affected systems. Two high-severity vulnerabilities stand out among the patches. The first (CVE-2024-0150) involves a buffer overflow in the GPU display driver that could lead to system compromise through data tampering and information disclosure. The second critical issue (CVE-2024-0146) affects the virtual GPU Manager, where a compromised guest system could trigger memory corruption, potentially leading to code execution and system takeover. For Windows systems, users must update to version 553.62 (R550 branch) or 539.19 (R535 branch). Linux users need to install version 550.144.03 or 535.230.02, depending on their driver branch.

The updates cover NVIDIA's RTX, Quadro, NVS, and Tesla product lines. Enterprise environments using NVIDIA's virtualization technology face additional risks. One vulnerability (CVE-2024-53881) allows guest systems to launch interrupt storms against host machines, potentially causing system-wide outages. To patch these security holes, virtual GPU software users must update to version 17.5 (550.144.02) or 16.9 (535.230.02). The vulnerabilities specifically target systems where attackers have local access, which means remote exploitation is unlikely. However, in virtualized environments where multiple users share GPU resources, these flaws pose a significant security risk. System administrators can download the security updates from NVIDIA's Driver Downloads page, while enterprise vGPU customers should obtain patches through the NVIDIA Licensing Portal. NVIDIA recommends immediate installation of these updates across all affected systems.



View at TechPowerUp Main Site | Source

 

[Vya Domus]

Don't want anyone getting their hands on that data other than Nvidia themselves.

 

[Mistral]

To rephrase the title a little, "nVidia Had a Driver Vulnerabilities That Allow Code Execution and Data Theft" for how long exactly?

 

[bug]

To rephrase the title a little, "nVidia Had a Driver Vulnerabilities That Allow Code Execution and Data Theft" for how long exactly?

Exploitable if an attacker has localhost access. If you were bitten by that, you have bigger issues than Nvidia's driver.

 

[TumbleGeorge]

Is it just me that it seems like Nvidia just reduced the gaming performance of its old series of video cards to make the new RTX 50 series stand out even more compared to them.?

 

[Onasi]

@TumbleGeorge
Yes, it’s the maintenance man. He knows I like orange. They do that on purpose.

 

[bug]

Is it just me that it seems like Nvidia just reduced the gaming performance of its old series of video cards to make the new RTX 50 series stand out even more compared to them.?

It's just you.
Where did you see the performance reduced?

 

[TumbleGeorge]

It's just you.
Where did you see the performance reduced?

I just ask.

 

[Vayra86]

Is it just me that it seems like Nvidia just reduced the gaming performance of its old series of video cards to make the new RTX 50 series stand out even more compared to them.?

Well no, something tipped you off on thinking that, right? You say it seems like.
I can accuse Nvidia of a lot, but purposely killing their own cards over time isn't one, despite all the doom and gloom stories that we've seen over time, and the supposed gap with AMD's fine wine approach that never materialized in earnest.

 

[danc]

I cant find these on nvidia site?

 

[The Norwegian Drone Pilot]

Isn't we already in the 566.xx driver release that is way newer?

 

[R-T-B]

Exploitable if an attacker has localhost access. If you were bitten by that, you have bigger issues than Nvidia's driver.

Or are a virtualization host, which is exactly what the vulnerable driver is for.

Isn't we already in the 566.xx driver release that is way newer?

This is for their paravirtualized enterprise driver for VMs. None of you are getting it.

 

[igormp]

Or are a virtualization host, which is exactly what the vulnerable driver is for.


This is for their paravirtualized enterprise driver for VMs. None of you are getting it.

Yeah, since it's mostly for their display part and the vGPU one, that's more related to systems that do multi-tenant out of a single GPU, stuff like their GRID offerings, or any other VDI solution people may be using.

 

[kondamin]

566.36 is what's being offered on the nvidia app thingy for me atleast.
It's been out since december 5th

Not that keen on keeping things i can patch unpached so what's up?

 

[Dr. Dro]

566.36 is what's being offered on the nvidia app thingy for me atleast.
It's been out since december 5th

Not that keen on keeping things i can patch unpached so what's up?

It does not apply to you on GeForce, these are for NVIDIA RTX GPUs (formerly Quadro). I have been running 553.50 on my RTX A2000 since I got it last week. Just upgrading to 553.62 now after reading this post.

Driver Details | NVIDIA

Download the <dd~LanguageName> <dd~Name> for <dd~OSName> systems. Released <dd~ReleaseDateTime>

www.nvidia.com

They've also patched the previous Release 535 driver:

Driver Details | NVIDIA

Download the <dd~LanguageName> <dd~Name> for <dd~OSName> systems. Released <dd~ReleaseDateTime>

www.nvidia.com

 

[_roman_]

Here you go.

Linux KERNEL + userspace + nvidia driver = insecure system

To rephrase the title a little, "nVidia Had a Driver Vulnerabilities That Allow Code Execution and Data Theft" for how long exactly?

It depends if the user is smart or not.

Linux users need to install version 550.144.03 or 535.230.02, depending on their driver branch.

I think that statement misses an information. Gentoo linux has another newer version also in the repository. Is that also affected? According to the text it is, becuase it does not say ... "or newer".

source: https://packages.gentoo.org/packages/x11-drivers/nvidia-drivers/changelog

x11-drivers/nvidia-drivers: add 550.144.03
3dd0860
Ionen Wolkens committed on 2025-01-16 17:34:24 UTC

x11-drivers/nvidia-drivers: add 535.230.02
2e117da
Ionen Wolkens committed on 2025-01-16 17:34:24 UTC

That does not look very good - a few days only. And already an annoucement for the issue.

On a sidenote: Nvidia is not really a recommendation for a box with a linux kernel. Lot'S of overhead. I tested it for a few months again in 2023.

 

[kondamin]

It does not apply to you on GeForce, these are for NVIDIA RTX GPUs (formerly Quadro). I have been running 553.50 on my RTX A2000 since I got it last week. Just upgrading to 553.62 now after reading this post.

Driver Details | NVIDIA

Download the <dd~LanguageName> <dd~Name> for <dd~OSName> systems. Released <dd~ReleaseDateTime>

www.nvidia.com

They've also patched the previous Release 535 driver:

Driver Details | NVIDIA

Download the <dd~LanguageName> <dd~Name> for <dd~OSName> systems. Released <dd~ReleaseDateTime>

www.nvidia.com

Ah, thanks for the clarification