NVIDIA GPU Display Driver Kernel Mode Vulnerability Leads to Denial of Service and Privilege Escalation
Overview
A high-severity vulnerability was discovered in the NVIDIA GPU display driver for Windows and Linux. The flaw resides in the kernel mode driver component responsible for processing shader commands. An unprivileged local user, or a sandboxed process such as an ML model training job within a container, can craft a malicious shader or send a malformed sequence of API calls to the driver. This triggers a race condition in the memory management unit of the driver, leading to a dereference of an invalid memory address. Successful exploitation results in a system crash, causing a Denial of Service (DoS) that can halt critical AI training or inference workloads. Security researchers also demonstrated that under specific circumstances, the race condition could be manipulated to achieve arbitrary code execution in the context of the kernel, leading to a full system compromise via privilege escalation. This vulnerability affects a wide range of consumer and data center GPUs, posing a significant risk to multi-tenant GPU-accelerated cloud environments where workloads from different customers may be co-located.
Affected Systems
Testing Guide
1. Check your current NVIDIA driver version. On Linux, run `nvidia-smi`. On Windows, open the NVIDIA Control Panel and go to Help > System Information. 2. Compare the installed driver version to the patched versions listed in the NVIDIA Security Bulletin for this CVE. 3. If your version is lower than the patched version (e.g., 555.58), your system is vulnerable.
Mitigation Steps
1. **Update Drivers Immediately:** Upgrade to NVIDIA driver version 555.58 or newer for GeForce/RTX cards, or R555 U1 / R535 U12 for data center GPUs. 2. **Restrict GPU Access:** In multi-tenant environments, use containerization and strict syscall filtering (e.g., seccomp) to limit direct interaction with the kernel driver. 3. **Monitor System Logs:** Monitor for unexpected kernel panics or driver crashes, which could indicate attempted exploitation.
Patch Details
Patches are available in NVIDIA driver versions 555.58 and newer. Refer to the official NVIDIA Security Bulletin for specific driver branches.