リモートのWindowsホストにインストールされているNVIDIA GPUディスプレイドライバーのバージョンは、340.x、341.x、342.00より前の342.x、375.63より前の375.xです。したがって、以下の複数の脆弱性による影響を受けます。

  - An array-indexing error exists in nvlddmkm.sys due to improper validation of input. A local attacker can exploit this to cause a denial of service condition or the execution of arbitrary code with elevated privileges. (CVE-2016-7381)

  - A flaw exists in nvlddmkm.sys due to missing permission checks. ローカルの攻撃者がこの脆弱性を悪用し、任意のメモリコンテンツを漏えいし、昇格した権限を得る可能性があります。
    (CVE-2016-7382)

  - A flaw exists in nvlddmkm.sys when handling memory mapping that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges. (CVE-2016-7383)

  - A flaw exists in nvlddmkm.sys when handling UVMLiteController device IO control input and output lengths. A local attacker can exploit this to execute arbitrary code with elevated privileges. (CVE-2016-7384)

  - An untrusted pointer dereference flaw exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x700010d. A local attacker can exploit this to cause a denial of service condition or the execution of arbitrary code with elevated privileges. (CVE-2016-7385)

  - A flaw exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x70000d4 that allows a local attacker to disclose uninitialized memory contents. (CVE-2016-7386)

  - A flaw exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x600000d that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges. (CVE-2016-7387)

  - A NULL pointer dereference flaw exists in nvlddmkm.sys that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges in certain unsafe configurations. (CVE-2016-7388)

  - An array-indexing error exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x7000194 that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges.
    (CVE-2016-7390)

  - A flaw exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x100010b that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges. (CVE-2016-7391)

  - A flaw exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x7000014 that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges. (CVE-2016-8805)

  - An untrusted pointer dereference flaw exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x5000027 that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges. (CVE-2016-8806)

  - A stack-based buffer overflow condition exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x10000e9 that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges. (CVE-2016-8807)

  - A buffer overflow condition exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x70000d that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges.
    (CVE-2016-8808)

  - A buffer overflow condition exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x70001b2 that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges.
    (CVE-2016-8809)

  - A buffer overflow condition exists in nvlddmkm.sys when handling DxgDdiEscape ID 0x100009a that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges.
    (CVE-2016-8810)

  - A flaw exists in nvlddmkm.sys driver when handling DxgDdiEscape ID 0x7000170 that allows a local attacker to cause a denial of service condition or the execution of arbitrary code with elevated privileges.
    (CVE-2016-8811)

  - A stack-based overflow condition exists in nvstreamkms.sys when handling executable paths. ローカルの攻撃者がこの脆弱性を悪用し、昇格した権限で任意のコードを実行する可能性があります。Note that this vulnerability only affects systems that also have GeForce Experience software installed. (CVE-2016-8812)

検出

NVIDIA Windows GPUディスプレイドライバー340.x/341.x/342.x < 342.00/375.x < 375.63の複数の脆弱性

high Nessus プラグイン ID 94576

バージョン 1.8