An update for NVIDIA GPU Display Driver was recently released, addressing 26 different security vulnerabilities, eight of which are considered high-severity flaws with a CVSS base score of between 7.1 and 8.8. Four vulnerabilities were also patched in the NVIDIA VGPU Software, 3 of which were also high-severity flaws. Last week, the Cisco Talos Intelligence Blog published further information about two exploitable memory driver corruption vulnerabilities that relate to one of the high-severity vulnerabilities that has been patched in this update. This flaw occurs in the shader functionality of an NVIDIA graphics GPU driver, specifically the NVIDIA D3D10 Driver. 

The high-severity vulnerability CVE-2022-34671, with a CVSS base score of 8.5, is described by NVIDIA as a vulnerability in the user mode layer. An attacker can exploit this vulnerability without using a highly privileged account, instead requiring the privileges of a regular user. An exploit can cause an out-of-bound write, which in turn can lead to further attacks such as arbitrary code execution, denial of service, and privilege escalation, or result in a way to demand a payment for the attackers through information disclosure and data tampering.  

The two vulnerabilities identified by Cisco Talos, TALOS-2022-1603 and TALOS-2022-1604, can exploit this vulnerability through a specially-crafted shader file executable, that can lead to memory corruption, where the attacker can then trigger CVE-2022-34671 through code execution and perform the attack. The attack is performed from a guest machine running a virtualisation environment such as VMware, qemu, or VirtualBox, or from a web browser using webGL and webassembly. The flaw is triggered from the HYPER-V guest, Microsoft’s interface for bi-directional file copying to a virtual machine. The exploit uses the now-deprecated RemoteFX to execute code on the HYPER-V host, in what is known as a guest-to-host escape.  

Users of the NVIDIA GPU D3D10 Driver Version 516.94 , 31.0.15.1694 are vulnerable to this exploit, however only older machines still using the RemoteFX software can fall victim to this form of attack. The software updates for all affected NVIDIA devices by any of the 30 recently patched vulnerabilities can be found listed in their security bulletin, and are available to download from the NVIDIA Driver Downloads page on their website. Users of the vGPU software or NVIDIA Cloud Gaming can also apply these security patches, which can be found on the NVIDIA Licensing Portal.