CVE-2022-31608

Published: 2 August 2022

NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

From the Ubuntu Security Team

Artem S. Tashkinov discovered that the NVIDIA graphics drivers Dynamic Boost D-Bus component did not properly restrict access to its endpoint. When enabled in non-default configurations, a local attacker could use this to cause a denial of service or possibly execute arbitrary code.

Notes

the dbus endpoint configuration file is only installed as a
documentation file (/usr/share/doc/nvidia-driver-*/nvidia-dbus.conf)
in Ubuntu, so a user would have to manually put it in place to be
affected.

some binary drivers are no longer support by NVidia, so they
are marked as ignored here

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31608
• https://nvidia.custhelp.com/app/answers/detail/a_id/5383
• https://ubuntu.com/security/notices/USN-5547-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/bugs/1982501