PT-2016-7307 · Nvidia+1 · Nvidia Gpu Display Driver+1

Published 2016-11-03 · Updated 2019-10-19 · CVE-2016-7389

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA GPU Display Driver on Linux versions prior to 304.132 NVIDIA GPU Display Driver on Linux versions prior to 340.98 NVIDIA GPU Display Driver on Linux versions prior to 367.55 NVIDIA GPU Display Driver on Linux versions prior to 361.93.03 NVIDIA GPU Display Driver on Linux versions prior to 370.28

Description The issue is related to improper input validation in the kernel mode layer handler for mmap(), which may allow users to gain access to arbitrary physical memory. This could lead to an escalation of privileges.

Recommendations For versions prior to 304.132, update to version 304.132 or later. For versions prior to 340.98, update to version 340.98 or later. For versions prior to 367.55, update to version 367.55 or later. For versions prior to 361.93.03, update to version 361.93.03 or later. For versions prior to 370.28, update to version 370.28 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-7389

MGASA-2017-0013

MGASA-2017-0025

USN-3122-1

Affected Products

Nvidia Gpu Display Driver

Ubuntu

References · 19

• https://advisories.mageia.org/MGASA-2017-0013.html · Security Note
• http://nvidia.custhelp.com/app/answers/detail/a_id/4246 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7389 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7389 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7382 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0013 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3122-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0025.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7389 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7389 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0025 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-7389 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-7389 · Security Note
• https://ubuntu.com/security/notices/USN-3122-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7389 · Security Note