CVE-2022-28191: Medium severity Nvidia Virtual GPU vulnerability
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where uncontrolled resource consumption can be triggered by an unprivileged regular user, which may lead to denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nvidia-graphics-driversto a version that resolves this vulnerability.Fixed in 535.261.03-1Fixed in 535.309.01-0+deb12u1Fixed in 550.163.01-2Fixed in 550.163.01-5.1Fixed in 550.163.01-6 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-470to a version that resolves this vulnerability.Fixed in 470.256.02-1~deb12u1Fixed in 470.256.02-10 - Upgrade
Upgrade
debian/nvidia-graphics-driversto a version that resolves this vulnerability.Fixed in 470.129.06-1 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-470to a version that resolves this vulnerability.Fixed in 470.129.06-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-28191?
CVE-2022-28191 has a medium severity level due to its potential for denial of service.
How do I fix CVE-2022-28191?
To fix CVE-2022-28191, update to a patched version of NVIDIA vGPU software that addresses the vulnerability.
What are the affected versions of NVIDIA vGPU software for CVE-2022-28191?
CVE-2022-28191 affects NVIDIA vGPU software versions from 11.0 to 11.8, 13.0 to 13.3, and the exact version 14.0.
Who can trigger the vulnerability CVE-2022-28191?
CVE-2022-28191 can be triggered by an unprivileged regular user, leading to uncontrolled resource consumption.
What impact does CVE-2022-28191 have on systems?
The impact of CVE-2022-28191 is a potential denial of service, which may disrupt the availability of GPU resources.