PT-2014-8449 · Nvidia+2 · Linux For Tegra (L4T) Driver+3

Published 2014-12-10 · Updated 2016-10-26 · CVE-2014-8298

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NVIDIA Linux Discrete GPU drivers versions prior to R304.125 NVIDIA Linux Discrete GPU drivers R331.x versions prior to R331.113 NVIDIA Linux Discrete GPU drivers R340.x versions prior to R340.65 NVIDIA Linux Discrete GPU drivers R343.x versions prior to R343.36 NVIDIA Linux Discrete GPU drivers R346.x versions prior to R346.22 Linux for Tegra (L4T) driver versions prior to R21.2 Chrome OS driver versions prior to R40

Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and X server crash, or possibly execute arbitrary code. This is achieved through a crafted GLX indirect rendering protocol request.

Recommendations For NVIDIA Linux Discrete GPU drivers versions prior to R304.125, update to version R304.125 or later. For NVIDIA Linux Discrete GPU drivers R331.x versions prior to R331.113, update to version R331.113 or later. For NVIDIA Linux Discrete GPU drivers R340.x versions prior to R340.65, update to version R340.65 or later. For NVIDIA Linux Discrete GPU drivers R343.x versions prior to R343.36, update to version R343.36 or later. For NVIDIA Linux Discrete GPU drivers R346.x versions prior to R346.22, update to version R346.22 or later. For Linux for Tegra (L4T) driver versions prior to R21.2, update to version R21.2 or later. For Chrome OS driver versions prior to R40, update to version R40 or later.

Fix

DoS

Weakness Enumeration

CWE-19

Related Identifiers

CVE-2014-8298

MGASA-2015-0005

USN-2438-1

Affected Products

Chromedriver

Linux For Tegra (L4T) Driver

Nvidia Linux Discrete Gpu Drivers

Ubuntu

References · 47

• https://ubuntu.com/security/notices/USN-2438-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8091 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8298 · Security Note
• https://ubuntu.com/security/CVE-2014-8298 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0005.html · Security Note
• https://bdu.fstec.ru/vul/2015-06584 · Security Note
• https://bdu.fstec.ru/vul/2015-06598 · Security Note
• https://bdu.fstec.ru/vul/2015-09279 · Security Note
• https://bdu.fstec.ru/vul/2015-09283 · Security Note
• https://bdu.fstec.ru/vul/2015-09286 · Security Note
• https://bdu.fstec.ru/vul/2015-06604 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8098 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0005 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06601 · Security Note
• https://bdu.fstec.ru/vul/2015-09275 · Security Note