PT-2017-3299 · Google+1 · Android+1
Publicado
2017-11-06
·
Atualizado
2019-10-03
·
CVE-2017-6264
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
NVIDIA GPU driver versions (affected versions not specified)
Android (affected versions not specified)
Description
The issue is related to insufficient access control in the NVIDIA GPU driver, specifically the gm20b clk throt set cdev state function. It allows a remote attacker to execute arbitrary code in the context of a privileged process. This is due to an out of bounds memory read being used as a function pointer, which could lead to code execution in the kernel. The issue is rated as high and could allow a local malicious application to execute arbitrary code within the context of a privileged process.
Recommendations
For the NVIDIA GPU driver, consider restricting access to the
gm20b clk throt set cdev state function until a patch is available.
For Android, at the moment, there is no information about a newer version that contains a fix for this vulnerability.Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Android
Nvidia Gpu Driver