CVE-2022-42261: Buffer Overflow
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nvidia-graphics-driversto a version that resolves this vulnerability.Fixed in 535.261.03-1Fixed in 535.309.01-0+deb12u1Fixed in 550.163.01-2Fixed in 550.163.01-5.1Fixed in 550.163.01-6 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-teslato a version that resolves this vulnerability.Fixed in 525.147.05-15~deb12u1Fixed in 525.147.05-19 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-450to a version that resolves this vulnerability.Fixed in 450.248.02-14 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-460to a version that resolves this vulnerability.Fixed in 460.106.00-24 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-470to a version that resolves this vulnerability.Fixed in 470.256.02-1~deb12u1Fixed in 470.256.02-10 - Upgrade
Upgrade
debian/nvidia-graphics-driversto a version that resolves this vulnerability.Fixed in 510.108.03-1 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-teslato a version that resolves this vulnerability.Fixed in 510.108.03-1 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-470to a version that resolves this vulnerability.Fixed in 470.161.03-1
Event History
Frequently Asked Questions
What is the vulnerability ID of this NVIDIA vGPU software vulnerability?
The vulnerability ID is CVE-2022-42261.
What is the severity of CVE-2022-42261?
The severity of CVE-2022-42261 is high (7.8).
What is the affected software?
The affected software includes Nvidia Virtual Gpu versions up to 11.11, versions between 12.0 and 13.6, and versions between 14.0 and 14.4.
What are the possible impacts of this vulnerability?
The possible impacts of this vulnerability include buffer overrun, data tampering, information disclosure, and denial of service.
Are Citrix Hypervisor, Linux Kernel, Redhat Enterprise Linux Kernel-based Virtual Machine, and Vmware Vsphere affected by this vulnerability?
Citrix Hypervisor, Linux Kernel, Redhat Enterprise Linux Kernel-based Virtual Machine, and Vmware Vsphere are not vulnerable to this vulnerability.