PT-2019-4575 · Nvidia · Nvidia Windows Gpu Display Driver

Published 2019-05-10 · Updated 2021-07-21 · CVE-2019-5675

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA Windows GPU Display driver software for Windows (all versions)

Description The issue is related to errors in synchronizing shared data, such as static variables across threads, in the DxgkDdiEscape function of the NVIDIA graphics processor software. This can lead to undefined behavior and unpredictable data changes. Exploitation of this issue may allow an attacker to cause a denial of service, escalate privileges, or disclose protected information.

Recommendations For all versions, consider disabling the DxgkDdiEscape function as a temporary workaround until a patch is available. Restrict access to the kernel mode layer handler to minimize the risk of exploitation. Avoid using shared data across threads in the affected handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-19

CWE-426

CWE-662

Related Identifiers

BDU:2020-00634

BDU:2020-00635

CVE-2019-5675

Affected Products

Nvidia Windows Gpu Display Driver

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-5675 · Security Note
• https://bdu.fstec.ru/vul/2020-00635 · Security Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/4797 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00634 · Security Note
• https://cxsecurity.com/cveshow/CVE-2019-5675 · Note
• https://cxsecurity.com/cveshow/CVE-2019-5676 · Note