CVE-2016-7387 : For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 3

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00 and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x600000D where a value passed from a user to the driver is used without validation as the index to an internal array, leading to denial of service or potential escalation of privileges.

Published 2016-11-08 20:59:13

Updated 2019-03-07 14:36:18

Source NVIDIA Corporation

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2016-7387

EPSS FAQ

0.14%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 48 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-7387

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2016-7387

http://nvidia.custhelp.com/app/answers/detail/a_id/4247

Security Bulletin: Vulnerabilities in NVIDIA Windows GPU Display Driver and NVIDIA GeForce Experience | NVIDIA
Patch;Vendor Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/40659/

NVIDIA Driver - Unchecked Write to User-Provided Pointer in Escape 0x600000D
Exploit;Third Party Advisory;VDB Entry
https://support.lenovo.com/us/en/solutions/LEN-10822

NVidia Windows GPU Display Driver Contains Multiple Vulnerabilities in the Kernel Mode Layer - US
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/93985

NVIDIA GPU Driver CVE-2016-7387 Local Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry

Products affected by CVE-2016-7387

Nvidia » Gpu Driver
Versions from including (>=) 375 and before (<) 375.63
cpe:2.3:a:nvidia:gpu_driver:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows
Nvidia » Gpu Driver
Versions from including (>=) 340 and before (<) 342.00
cpe:2.3:a:nvidia:gpu_driver:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows

Vulnerability Details : CVE-2016-7387

Exploit prediction scoring system (EPSS) score for CVE-2016-7387

CVSS scores for CVE-2016-7387

CWE ids for CVE-2016-7387

References for CVE-2016-7387

Products affected by CVE-2016-7387