PT-2019-17814 · Nvidia · Nvuflash Tool+2

Publicado 2019-11-18 · Atualizado 2021-07-21 · CVE-2019-5688

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA NVFlash, NVUFlash Tool versions prior to 5.588.0 GPUModeSwitch Tool versions prior to 2019-11 NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) (affected versions not specified)

Description The issue allows authenticated users with administrative privileges to access device memory and registers of other devices not managed by NVIDIA. This can potentially lead to escalation of privileges, information disclosure, or denial of service.

Recommendations For NVIDIA NVFlash, NVUFlash Tool versions prior to 5.588.0, update to version 5.588.0 or later. For GPUModeSwitch Tool versions prior to 2019-11, update to a version from 2019-11 or later. As a temporary workaround, consider restricting access to the NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2019-5688

Produtos afetados

Gpumodeswitch Tool

Nvidia Nvflash

Nvuflash Tool

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-5688 · Aviso do Fabricante
• https://nvidia.custhelp.com/app/answers/detail/a_id/4928 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-5688 · Nota de Segurança