CVE-2022-28185: High severity Nvidia Virtual GPU vulnerability
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the ECC layer, where an unprivileged regular user can cause an out-of-bounds write, which may lead to denial of service and data tampering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nvidia-graphics-driversto a version that resolves this vulnerability.Fixed in 535.261.03-1Fixed in 535.309.01-0+deb12u1Fixed in 550.163.01-2Fixed in 550.163.01-5.1Fixed in 550.163.01-6 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-legacy-390xxto a version that resolves this vulnerability.Fixed in 390.157-16 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-450to a version that resolves this vulnerability.Fixed in 450.248.02-14 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-470to a version that resolves this vulnerability.Fixed in 470.256.02-1~deb12u1Fixed in 470.256.02-10 - Upgrade
Upgrade
debian/nvidia-graphics-driversto a version that resolves this vulnerability.Fixed in 470.129.06-1 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-470to a version that resolves this vulnerability.Fixed in 470.129.06-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28185?
CVE-2022-28185 is considered a critical vulnerability that can lead to denial of service and data tampering.
How do I fix CVE-2022-28185?
To fix CVE-2022-28185, you should update the NVIDIA GPU Display Driver to a version above the affected versions listed.
Who is affected by CVE-2022-28185?
CVE-2022-28185 affects users of the NVIDIA vGPU Software versions between 11.0-11.8 and 13.0-13.3, as well as version 14.0.
What are the risks associated with CVE-2022-28185?
The risks include potential system crashes due to denial of service and unauthorized data manipulation.
Is CVE-2022-28185 applicable to Linux kernel or Windows OS?
No, CVE-2022-28185 specifically affects the NVIDIA GPU Display Driver and does not impact the Linux kernel or Windows OS directly.