Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Gentoo: GLSA-201304-01 High: NVIDIA Drivers Privilege Elevated Access

gentoo
Calendar Grey April 8, 2013
Scroller Gentoo
Recent vulnerabilities in NVIDIA drivers on Gentoo may lead to unauthorized local access. Users are advised to upgrade for enhanced security.
Two vulnerabilities in NVIDIA drivers may allow a local attacker to gain escalated privileges.

Summary

Two vulnerabilities have been discovered in NVIDIA drivers: * A vulnerability has been found in the way NVIDIA drivers handle read/write access to GPU device nodes, allowing access to arbitrary system memory locations (CVE-2012-4225). * A buffer overflow error has been discovered in NVIDIA drivers (CVE-2013-0131).
NOTE: Exposure to CVE-2012-4225 is reduced in Gentoo due to 660 permissions being used on the GPU device nodes by default.

Topics%20covered

Topics Covered

security advisory high severity gentoo privilege escalation nvidia drivers

Resolution

All NVIDIA driver users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=x11-drivers/nvidia-drivers-304.88"

References

[ 1 ] CVE-2012-4225 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4225 [ 2 ] CVE-2013-0131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0131

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201304-01
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: High
Title: NVIDIA Drivers: Privilege escalation
Date: April 08, 2013
Bugs: #429614, #464248
ID: 201304-01

Topics%20covered

Topics Covered

security advisory high severity gentoo privilege escalation nvidia drivers

Synopsis

Two vulnerabilities in NVIDIA drivers may allow a local attacker to gain escalated privileges.

Background

The NVIDIA drivers provide X11 and GLX support for NVIDIA graphic boards.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 x11-drivers/nvidia-drivers < 304.88 >= 304.88

Impact

===== A local attacker could gain escalated privileges.

Workaround

There is no known workaround at this time.