Security Bulletin: Unprivileged GPU access vulnerability - CVE-2013-5987

Summary

NVIDIA device driver bug that could allow an unprivileged user to control target system.

Vulnerability Details

Abstract

NVIDIA device driver bug that could allow an unprivileged user to control target system.

Content

Vulnerability Details:

CVE ID: CVE-2013-5987

Description:
NVIDIA Graphics Drivers could allow a local attacker to gain elevated privileges on the system, caused by the failure to restrict access to the GPU. An attacker could exploit this vulnerability using unprivileged user-mode software to gain elevated privileges on the system.

CVSS:
CVSS Base Score: 4.6
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/89440&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P)

Affected products and versions

All IBM Systems that have one or more of the following NVIDIA Products installed.
NVIDIA Tesla M2xxx, K10, K20, K40 series GPUs
NVIDIA Quadro 6xx, 1xxx, 2xxx, 3xxx, 4xxx, 5xxx, 6xxx, K6xx, K2xxx, K4xxx, K5xxx, K6xxx series GPUs
NVIDIA Grid GPUs

• BladeCenter HS22/HS22V with BladeCenter GPU Expansion Device
• BladeCenter HS23/HS23E with BladeCneter GPU Expansion Device
• Flex System x220 Compute node with PCIExpress Expansion Node
• Flex System x240 Compute node with PCIExpress Expansion Node
• System x iDataPlex dx360 M2
• System x iDataPlex dx360 M3
• System x iDataPlex dx360 M4
• System x3100 M4
• System x3200 M3
• System x3250 M3
• System x3250 M4
• System x3300 M4
• System x3400 M2
• System x3400 M3
• System x3500 M2
• System x3500 M3
• System x3500 M4
• System x3520 M4
• System x3530 M4
• System x3550 M2
• System x3550 M3
• System x3550 M4
• System x3620 M3
• System x3630 M3
• System x3630 M4
• System x3650 M2
• System x3650 M3
• System x3650 M4
• System x3690 X5
• System x3750 M4
• System x3850 X5

Remediation:

Vendor Fix:

Windows OS: The NVIDIA Windows driver update from branch R331 has the fix for these issues. Driver is available immediately for download from www.nvidia.com.
Windows 64bit:<http://www.nvidia.com/download/driverResults.aspx/69326/en-us&gt;

The R331 Windows Driver is also available for download from IBM FixCentral.
R331 64bit Link:
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5094244&brandind=5000008

Linux OS: The NVIDIA Linux driver update from branch R331 has the fix for these issues. Driver is available immediately for download from www.nvidia.com. NVIDIA has also provided fix updates for the R319 branch that are available for download from www.nvidia.com.
R331 64bit link: <http://www.nvidia.com/download/driverResults.aspx/69372/en-us&gt;
R319 64bit Link: <http://www.nvidia.com/download/driverResults.aspx/69378/en-us&gt;

The R319 Linux Driver is also available for download from IBM FixCentral.
R319 64bit Link:
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093818&brandind=5000008

Workaround(s) & Mitigation(s):

None.

References:

• Complete CVSS Guide
• On-line Calculator V2

Related Information:
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
NVIDIA Security Bulletin:

<http://nvidia.custhelp.com/app/answers/detail/a_id/3377&gt;

Acknowledgement
None

Change History
January 13, 2014 – Original Publish Date

• The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Flash.

Note: According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.