[!] NVIDIA releases GPU driver update to fix 29 security flaws

[MarsM4N]

NVIDIA has released a security update for its GPU display driver for Windows, containing a fix for a high-severity flaw that threat actors can exploit to perform, among other things, code execution and privilege escalation. The latest security update addresses 25 vulnerabilities on the Windows and Linux GPU drivers, while seven flaws are categorized as high-severity.

The two most critical vulnerabilities are:

• CVE-2022-34669 (CVSS v3.1: 8.8) – Locally exploited user mode flaw in the Windows GPU driver allowing an unprivileged regular user to access or modify files critical to the application, potentially leading to code execution, privilege escalation, information disclosure, data tampering, and denial of service.
• CVE-2022-34671 (CVSS v3.1: 8.5) – Remotely exploited user mode flaw in the Windows GPU driver allowing an unprivileged regular user to cause an out-of-bounds write, potentially leading to code execution, privilege escalation, information disclosure, data tampering, and denial of service.

NVIDIA releases GPU driver update to fix 29 security flaws

NVIDIA has released a security update for its GPU display driver for Windows, containing a fix for a high-severity flaw that threat actors can exploit to perform, among other things, code execution and privilege escalation.

www.bleepingcomputer.com

Members of "Team Green" better update their drivers ASAP!

 

[Solaris17]

high-severity flaw

https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1029

 

[wolf]

Members of "Team Green" better update their drivers ASAP!

Unless you have a compelling reason to be on older drivers, users from either "Team" should be updating their drivers. Certainly seems like "Team Red" has their fair share.

Side note, I think this Team thing is ultra dumb.

 

[MarsM4N]

Unless you have a compelling reason to be on older drivers, users from either "Team" should be updating their drivers. Certainly seems like "Team Red" has their fair share.

Side note, I think this Team thing is ultra dumb.

Was just a heads up for folks to keep their drivers up to date. And the "Team Green" was just a side kick for the "Nvidia has superior drivers" users.

 

[thesmokingman]

It's lame that there is no universal safe zone anymore, nothing sacred. Hackers now going after gamers and our hardware.

 

[eidairaman1]

Unless you have a compelling reason to be on older drivers, users from either "Team" should be updating their drivers. Certainly seems like "Team Red" has their fair share.

Side note, I think this Team thing is ultra dumb.

Even when the latest drivers cause problems?

Idts

 

[claes]

Why are you so mean on a tech forum lol

 

[wolf]

Even when the latest drivers cause problems?

I think this was adequately covered by my comment.

Unless you have a compelling reason to be on older drivers, users from either "Team" should be updating their drivers.

There certainly are compelling reasons not to, but those will vary wildly from user to user.

 

[Frick]

Unless you have a compelling reason to be on older drivers, users from either "Team" should be updating their drivers. Certainly seems like "Team Red" has their fair share.

Side note, I think this Team thing is ultra dumb.

I do the opposite: I only ever update drivers if I have to.

 

[birdie]

So much fear-mongering it's almost stultifying.

• All GPU vendors constantly release security updates for their drivers, that includes not only NVIDIA but AMD, Intel, Google, Qualcomm or even Apple.
• Almost all these vulnerabilities are near impossible to exploit remotely because at the very least they require you to run WebGL which not that many websites do. And to be honest I don't remember any GPU vulnerabilities over the past decade if ever which have been exploited by using WebGL.
• Those deemed critical in terms of running code locally require you to basically download and intentionally run malware. If you have any half-decent Windows antivirus those will be stopped right away. Even Windows Defender will prevent such malware from running. It's a lot easier to just email you basic malware which will install itself into any of five dozen Autorun locations in Windows and not bother with getting Administrator privileges which are redundant for absolute home users out there 'cause you have all your passwords stored in your user account anyways.

 

[claes]

More, vulnerabilities are typically found by the developers themselves or reported before they’re exploited. Most security vulnerabilities aren’t “out in the world” before they’re patched.

 

[R-T-B]

It's lame that there is no universal safe zone anymore, nothing sacred. Hackers now going after gamers and our hardware.

Hackers have always been after whatever is available. You were always a target since day 1.

So much fear-mongering it's almost stultifying.

• All GPU vendors constantly release security updates for their drivers, that includes not only NVIDIA but AMD, Intel, Google, Qualcomm or even Apple.
• Almost all these vulnerabilities are near impossible to exploit remotely because at the very least they require you to run WebGL which not that many websites do. And to be honest I don't remember any GPU vulnerabilities over the past decade if ever which have been exploited by using WebGL.
• Those deemed critical in terms of running code locally require you to basically download and intentionally run malware. If you have any half-decent Windows antivirus those will be stopped right away. Even Windows Defender will prevent such malware from running. It's a lot easier to just email you basic malware which will install itself into any of five dozen Autorun locations in Windows and not bother with getting Administrator privileges which are redundant for absolute home users out there 'cause you have all your passwords stored in your user account anyways.

Also, this. Storm in a friggin teacup. Your more likely to get a virus from gmod lua scripts. If you don't depend on user-admin isolation to function, don't fret this.