CVE-2022-42261: Buffer Overflow
First published: Fri Dec 30 2022(Updated: )
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.
Credit: psirt@nvidia.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nvidia Virtual GPU Graphics Driver | <11.11 | |
| Nvidia Virtual GPU Graphics Driver | >=12.0<13.6 | |
| Nvidia Virtual GPU Graphics Driver | >=14.0<14.4 | |
| Citrix Hypervisor | ||
| Linux Kernel | ||
| Red Hat Enterprise Linux Kernel-based Virtual Machine | ||
| VMware vSphere | ||
| NVIDIA Cloud Gaming | <525.60.12 | |
| NVIDIA GPU Display Driver | >=470<470.161.03 | |
| NVIDIA GPU Display Driver | >=510<510.108.03 | |
| NVIDIA GeForce | ||
| NVIDIA NVS Firmware | ||
| NVIDIA | ||
| NVIDIA RTX | ||
| NVIDIA GPU Display Driver | >=450<450.216.04 | |
| NVIDIA |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this NVIDIA vGPU software vulnerability?
The vulnerability ID is CVE-2022-42261.
What is the severity of CVE-2022-42261?
The severity of CVE-2022-42261 is high (7.8).
What is the affected software?
The affected software includes Nvidia Virtual Gpu versions up to 11.11, versions between 12.0 and 13.6, and versions between 14.0 and 14.4.
What are the possible impacts of this vulnerability?
The possible impacts of this vulnerability include buffer overrun, data tampering, information disclosure, and denial of service.
Are Citrix Hypervisor, Linux Kernel, Redhat Enterprise Linux Kernel-based Virtual Machine, and Vmware Vsphere affected by this vulnerability?
Citrix Hypervisor, Linux Kernel, Redhat Enterprise Linux Kernel-based Virtual Machine, and Vmware Vsphere are not vulnerable to this vulnerability.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/severity
- agent/event
- agent/source
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/nvidia
- canonical/nvidia virtual gpu graphics driver
- version/nvidia virtual gpu graphics driver/12.0
- version/nvidia virtual gpu graphics driver/14.0
- vendor/citrix
- canonical/citrix hypervisor
- vendor/linux
- canonical/linux kernel
- vendor/redhat
- canonical/red hat enterprise linux kernel-based virtual machine
- vendor/vmware
- canonical/vmware vsphere
- canonical/nvidia cloud gaming
- canonical/nvidia gpu display driver
- version/nvidia gpu display driver/470
- version/nvidia gpu display driver/510
- canonical/nvidia geforce
- canonical/nvidia nvs firmware
- canonical/nvidia
- canonical/nvidia rtx
- version/nvidia gpu display driver/450