CVE-2016-8812 : For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before G

For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before GFE 3.1.0.52 contains a vulnerability in the kernel mode layer (nvstreamkms.sys) allowing a user to cause a stack buffer overflow with specially crafted executable paths, leading to a denial of service or escalation of privileges.

Published 2016-11-08 20:59:26

Updated 2017-09-03 01:29:15

Source NVIDIA Corporation

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2016-8812

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-8812

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	2.0	6.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-8812

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-8812

http://nvidia.custhelp.com/app/answers/detail/a_id/4247

Security Bulletin: Vulnerabilities in NVIDIA Windows GPU Display Driver and NVIDIA GeForce Experience | NVIDIA
Patch;Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/93986

NVIDIA GPU Driver CVE-2016-8812 Local Stack Buffer Overflow Vulnerability
Third Party Advisory;VDB Entry
https://www.exploit-db.com/exploits/40660/

NVIDIA Driver - NvStreamKms 'PsSetCreateProcessNotifyRoutineEx Local Stack Buffer Overflow Callback / Local Privilege Escalation

Products affected by CVE-2016-8812

Nvidia » Geforce Experience
Versions up to, including, (<=) -
cpe:2.3:a:nvidia:geforce_experience:*:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce 910m » Version: N/A
When used together with: Nvidia » Geforce 920m » Version: N/A
When used together with: Nvidia » Geforce 920mx » Version: N/A
When used together with: Nvidia » Geforce 930m » Version: N/A
When used together with: Nvidia » Geforce 930mx » Version: N/A
When used together with: Nvidia » Geforce 940m » Version: N/A
When used together with: Nvidia » Geforce 940mx » Version: N/A
When used together with: Nvidia » Geforce 945m » Version: N/A
When used together with: Nvidia » Geforce Gt 710 » Version: N/A
When used together with: Nvidia » Geforce Gt 730 » Version: N/A
When used together with: Nvidia » Geforce Gtx 1050 » Version: N/A
When used together with: Nvidia » Geforce Gtx 1060 » Version: N/A
When used together with: Nvidia » Geforce Gtx 1070 » Version: N/A
When used together with: Nvidia » Geforce Gtx 1080 » Version: N/A
When used together with: Nvidia » Geforce Gtx 950m » Version: N/A
When used together with: Nvidia » Geforce Gtx 960m » Version: N/A
When used together with: Nvidia » Geforce Gtx 965m » Version: N/A
When used together with: Nvidia » Nvs 310 » Version: N/A
When used together with: Nvidia » Nvs 315 » Version: N/A
When used together with: Nvidia » Nvs 510 » Version: N/A
When used together with: Nvidia » Nvs 810 » Version: N/A
When used together with: Nvidia » Quadro K1200 » Version: N/A
When used together with: Nvidia » Quadro K420 » Version: N/A
When used together with: Nvidia » Quadro K620 » Version: N/A
When used together with: Nvidia » Quadro M1000m » Version: N/A
When used together with: Nvidia » Quadro M2000 » Version: N/A
When used together with: Nvidia » Quadro M2000m » Version: N/A
When used together with: Nvidia » Quadro M3000m » Version: N/A
When used together with: Nvidia » Quadro M4000 » Version: N/A
When used together with: Nvidia » Quadro M4000m » Version: N/A
When used together with: Nvidia » Quadro M5000 » Version: N/A
When used together with: Nvidia » Quadro M5000m » Version: N/A
When used together with: Nvidia » Quadro M500m » Version: N/A
When used together with: Nvidia » Quadro M5500 » Version: N/A
When used together with: Nvidia » Quadro M6000 » Version: N/A
When used together with: Nvidia » Quadro M600m » Version: N/A
When used together with: Nvidia » Quadro P5000 » Version: N/A
When used together with: Nvidia » Quadro P6000 » Version: N/A
When used together with: Nvidia » Titan X » Version: N/A

Vulnerability Details : CVE-2016-8812

Exploit prediction scoring system (EPSS) score for CVE-2016-8812

CVSS scores for CVE-2016-8812

CWE ids for CVE-2016-8812

References for CVE-2016-8812

Products affected by CVE-2016-8812