CVE-2016-4960: Input Validation
Published Nov 8, 2016
·Updated
For the NVIDIA Quadro, NVS, and GeForce products, the NVIDIA NVStreamKMS.sys service component is improperly validating user-supplied data through its API entry points causing an elevation of privilege.
Affected Software
40 affected components
Nvidia GeForce Experience
Nvidia Geforce 910m
Nvidia Geforce 920m
Nvidia Geforce 920mx
Nvidia Geforce 930m
Nvidia Geforce 930mx
Nvidia Geforce 940m
Nvidia Geforce 940mx
Nvidia Geforce 945m
Nvidia Geforce Gt 710
Nvidia Geforce Gt 730
Nvidia Geforce Gtx 1050
Nvidia Geforce Gtx 1060
Nvidia Geforce Gtx 1070
Nvidia Geforce Gtx 1080
Nvidia Geforce Gtx 950m
Nvidia Geforce Gtx 960m
Nvidia Geforce Gtx 965m
Nvidia Nvs 310
Nvidia Nvs 315
Nvidia Nvs 510
Nvidia Nvs 810
Nvidia Quadro K1200
Nvidia Quadro K420
Nvidia Quadro K620
Nvidia Quadro M1000m
Nvidia Quadro M2000
Nvidia Quadro M2000m
Nvidia Quadro M3000m
Nvidia Quadro M4000
Nvidia Quadro M4000m
Nvidia Quadro M5000
Nvidia Quadro M5000m
Nvidia Quadro M500m
Nvidia Quadro M5500
Nvidia Quadro M6000
Nvidia Quadro M600m
Nvidia Quadro P5000
Nvidia Quadro P6000
Nvidia Titan X
Remediation
Patch Available
Event History
Nov 8, 2016
CVE Published
via MITRE·08:37 PM
Data Sourced
via MITRE·08:37 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2016-4960?
CVE-2016-4960 has been classified with a high severity due to its potential for elevation of privilege.
2
How do I fix CVE-2016-4960?
To mitigate CVE-2016-4960, users should update their NVIDIA drivers to the latest version provided by NVIDIA.
3
Which NVIDIA products are affected by CVE-2016-4960?
CVE-2016-4960 affects several NVIDIA Quadro, NVS, and GeForce products, specifically those utilizing the NVStreamKMS.sys service.
4
What type of vulnerability is CVE-2016-4960?
CVE-2016-4960 is classified as a privilege escalation vulnerability.
5
Can CVE-2016-4960 be exploited remotely?
CVE-2016-4960 primarily requires local access to exploit the vulnerability, rather than a remote attack.