PT-2015-2747 · Nvidia · Nvidia Gpu Graphics Driver

James Forshaw · Published 2015-11-24 · Updated 2019-02-13 · CVE-2015-7865

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA GPU graphics driver versions R340 through 341.92 NVIDIA GPU graphics driver versions R352 through 354.35 NVIDIA GPU graphics driver versions R358 through 358.87

Description The issue is related to insufficient access control in the nvSCPAPISvr.exe file of the Stereoscopic 3D Driver Service component. Exploitation of this issue can allow a local attacker to elevate privileges using the command line, leveraging registry keys stored in HKEY LOCAL MACHINE.

Recommendations For versions R340 through 341.92, update to version 341.92 or later. For versions R352 through 354.35, update to version 354.35 or later. For versions R358 through 358.87, update to version 358.87 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2015-12112

CVE-2015-7865

Affected Products

Nvidia Gpu Graphics Driver

References · 8

• 🔥 https://code.google.com/p/google-security-research/issues/detail?id=515 · Exploit
• 🔥 https://exploit-db.com/exploits/38792 · Exploit
• http://nvidia.custhelp.com/app/answers/detail/a_id/3807/kw/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7865 · Security Note
• https://bdu.fstec.ru/vul/2015-12112 · Security Note
• https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04971867 · Vendor Advisory
• http://securitytracker.com/id/1034173 · Note
• http://packetstormsecurity.com/files/134520/NVIDIA-Stereoscopic-3D-Driver-Service-Arbitrary-Run-Key-Creation.html · Note