PT-2012-1175 · Nvidia · Nvidia Driver

Marc Deslauriers · Published 2012-11-19 · Updated 2013-08-22 · CVE-2012-4225

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nvidia-drivers versions prior to 304.88

Description The issue concerns multiple vulnerabilities in the nvidia-drivers package, which can be exploited locally to compromise the confidentiality, integrity, and availability of protected information. Specifically, it allows local users to write to arbitrary physical memory locations and gain privileges by modifying the VGA window using /dev/nvidia0.

Recommendations For versions prior to 304.88, update to version 304.88 or later to resolve the issue. As a temporary workaround, consider restricting access to /dev/nvidia0 to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-09717

CVE-2012-4225

Affected Products

Nvidia Driver

References · 11

• https://osv.dev/vulnerability/CVE-2012-4225 · Vendor Advisory
• http://nvidia.custhelp.com/app/answers/detail/a_id/3140 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09717 · Security Note
• http://security.gentoo.org/glsa/glsa-201304-01.xml · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4225 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4225 · Security Note
• http://openwall.com/lists/oss-security/2012/08/01/1 · Note
• http://seclists.org/fulldisclosure/2012/Aug/76 · Note
• http://seclists.org/fulldisclosure/2012/Aug/4 · Note
• http://openwall.com/lists/oss-security/2012/08/08/4 · Note