PT-2023-1554 · Nvidia · Nvidia Geforce Experience

Minse Kim · Published 2023-01-30 · Updated 2023-02-14 · CVE-2022-42291

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions NVIDIA GeForce Experience (affected versions not specified)

Description The issue is related to the installer of the NVIDIA GeForce Experience software, where a user may inadvertently delete data from a linked location, potentially leading to data tampering. This occurs due to incorrect link resolution before file access. An attacker does not have explicit control over the exploitation, which requires the user to launch the installer from a compromised directory. The exploitation may allow a remote attacker to delete arbitrary data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insecure Operation on Windows Junction

Link Following

Improper Resource Release

Weakness Enumeration

CWE-1386

CWE-59

CWE-404

Related Identifiers

BDU:2023-01010

CVE-2022-42291

Affected Products

Nvidia Geforce Experience

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-42291 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42291 · Vendor Advisory
• https://nvidia.custhelp.com/app/answers/detail/a_id/5384 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01010 · Security Note
• https://t.me/cibsecurity/57644 · Telegram Post