CVE-2022-42262: Buffer Overflow
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nvidia-graphics-driversto a version that resolves this vulnerability.Fixed in 535.261.03-1Fixed in 535.309.01-0+deb12u1Fixed in 550.163.01-2Fixed in 550.163.01-5.1Fixed in 550.163.01-6 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-teslato a version that resolves this vulnerability.Fixed in 525.147.05-15~deb12u1Fixed in 525.147.05-19 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-450to a version that resolves this vulnerability.Fixed in 450.248.02-14 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-460to a version that resolves this vulnerability.Fixed in 460.106.00-24 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-470to a version that resolves this vulnerability.Fixed in 470.256.02-1~deb12u1Fixed in 470.256.02-10 - Upgrade
Upgrade
debian/nvidia-graphics-driversto a version that resolves this vulnerability.Fixed in 510.108.03-1 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-teslato a version that resolves this vulnerability.Fixed in 510.108.03-1 - Upgrade
Upgrade
debian/nvidia-graphics-drivers-tesla-470to a version that resolves this vulnerability.Fixed in 470.161.03-1
Event History
Frequently Asked Questions
What is CVE-2022-42262?
CVE-2022-42262 is a vulnerability in the NVIDIA vGPU software Virtual GPU Manager (vGPU plugin) that can lead to buffer overrun, data tampering, information disclosure, or denial of service.
Which software is affected by CVE-2022-42262?
NVIDIA Virtual GPU software versions 11.11 to 13.6 and 14.0 to 14.4 are affected by CVE-2022-42262.
What is the severity of CVE-2022-42262?
The severity of CVE-2022-42262 is high (CVSS score 7.8).
How can CVE-2022-42262 be exploited?
CVE-2022-42262 can be exploited by sending specially crafted input to the Virtual GPU Manager, causing a buffer overrun.
Is there a fix available for CVE-2022-42262?
Yes, NVIDIA has released a fix for CVE-2022-42262. It is recommended to update to the latest version of the NVIDIA vGPU software.