PT-2015-5142 · Nvidia · Nvidia Gpu Display Driver

James Forshaw · Published 2015-03-06 · Updated 2016-12-08 · CVE-2015-1170

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA Display Driver R304 versions prior to 309.08 NVIDIA Display Driver R340 versions prior to 341.44 NVIDIA Display Driver R343 versions prior to 345.20 NVIDIA Display Driver R346 versions prior to 347.52

Description The issue allows local users to gain administrator privileges due to improper validation of local client impersonation levels during a "kernel administrator check". This can be achieved via unspecified API calls.

Recommendations For NVIDIA Display Driver R304 versions prior to 309.08, update to version 309.08 or later. For NVIDIA Display Driver R340 versions prior to 341.44, update to version 341.44 or later. For NVIDIA Display Driver R343 versions prior to 345.20, update to version 345.20 or later. For NVIDIA Display Driver R346 versions prior to 347.52, update to version 347.52 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-1170

Affected Products

Nvidia Gpu Display Driver

References · 7

• http://marc.info/?l=bugtraq&m=143013598825091&w=2 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=142781493222653&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1170 · Security Note
• http://nvidia.custhelp.com/app/answers/detail/a_id/3634 · Vendor Advisory
• https://support.lenovo.com/product_security/nvidia_windows_privilege · Note
• https://support.lenovo.com/us/en/product_security/nvidia_windows_privilege · Note
• http://securitytracker.com/id/1032013 · Note