Lucene search

NvidiaCVE-2019-5695

HistoryNov 12, 2019 - 9:15 p.m.

CVE-2019-5695

2019-11-1221:15:12

CWE-427

nvidia

web.nvd.nist.gov

cve-2019-5695

nvidia

geforce experience

windows

gpu display driver

dll preloading

vulnerability

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

Percentile

5.1%

JSON

NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in the local service provider component in which an attacker with local system and privileged access can incorrectly load Windows system DLLs without validating the path or signature (also known as a binary planting or DLL preloading attack), which may lead to denial of service or information disclosure through code execution.

Affected configurations

Nvd

Node

nvidiageforce_experienceRange<3.20.1

Node

nvidiagpu_driver

AND

microsoftwindowsMatch-

CNA Affected

[
  {
    "product": "NVIDIA GeForce Experience",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 3.20.1"
      }
    ]
  },
  {
    "product": "NVIDIA Windows GPU Display Driver",
    "vendor": "NVIDIA",
    "versions": [
      {
        "status": "affected",
        "version": "all versions"
      }
    ]
  }
]

References

nvidia.custhelp.com/app/answers/detail/a_id/4860

nvidia.custhelp.com/app/answers/detail/a_id/4907

safebreach.com/Post/NVIDIA-GPU-Display-Drivers-for-Windows-and-GFE-Software-DLL-Preloading-and-Potential-Abuses-CVE-2019-5694-CVE-2019-5695

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-5695