PT-2019-17814 · Nvidia · Nvuflash Tool+2

Published 2019-11-18 · Updated 2021-07-21 · CVE-2019-5688

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA NVFlash, NVUFlash Tool versions prior to 5.588.0 GPUModeSwitch Tool versions prior to 2019-11 NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) (affected versions not specified)

Description The issue allows authenticated users with administrative privileges to access device memory and registers of other devices not managed by NVIDIA. This can potentially lead to escalation of privileges, information disclosure, or denial of service.

Recommendations For NVIDIA NVFlash, NVUFlash Tool versions prior to 5.588.0, update to version 5.588.0 or later. For GPUModeSwitch Tool versions prior to 2019-11, update to a version from 2019-11 or later. As a temporary workaround, consider restricting access to the NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2019-5688

Affected Products

Gpumodeswitch Tool

Nvidia Nvflash

Nvuflash Tool

References · 3

• https://osv.dev/vulnerability/CVE-2019-5688 · Vendor Advisory
• https://nvidia.custhelp.com/app/answers/detail/a_id/4928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5688 · Security Note