CVE-2018-3979 : A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display

A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPU shader execution. A specially crafted pixel shader can cause remote denial-of-service issues. An attacker can provide a specially crafted website to trigger this vulnerability. This vulnerability can be triggered remotely after the user visits a malformed website. No further user interaction is required. Vulnerable versions include Ubuntu 18.04 LTS (linux 4.15.0-29-generic x86_64), Nouveau Display Driver NV117 (vermagic: 4.15.0-29-generic SMP mod_unload).

Published 2019-04-01 21:30:43

Updated 2023-02-09 01:38:12

Source Talos

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2018-3979

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 41 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-3979

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.4	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H	2.8	4.0	Talos
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: None Integrity: None Availability: High
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2018-3979

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2018-3979

Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Nvidia » Geforce Gtx 745 Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_745_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 745 » Version: N/A
Nvidia » Geforce Gtx 750 Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_750_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 750 » Version: N/A
Nvidia » Geforce Gtx 750 Ti Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_750_ti_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 750 Ti » Version: N/A
Nvidia » Geforce Gtx 840m Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_840m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 840m » Version: N/A
Nvidia » Geforce Gtx 845m Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_845m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 845m » Version: N/A
Nvidia » Geforce Gtx 850m Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_850m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 850m » Version: N/A
Nvidia » Geforce Gtx 860m Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_860m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 860m » Version: N/A
Nvidia » Geforce Gtx 950m Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_950m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 950m » Version: N/A
Nvidia » Geforce Gtx 960m Firmware » Version: N/A
cpe:2.3:o:nvidia:geforce_gtx_960m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Geforce Gtx 960m » Version: N/A
Nvidia » Quadro K620 Firmware » Version: N/A
cpe:2.3:o:nvidia:quadro_k620_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Quadro K620 » Version: N/A
Nvidia » Quadro K1200 Firmware » Version: N/A
cpe:2.3:o:nvidia:quadro_k1200_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Quadro K1200 » Version: N/A
Nvidia » Quadro K2200 Firmware » Version: N/A
cpe:2.3:o:nvidia:quadro_k2200_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Quadro K2200 » Version: N/A
Nvidia » Quadro M1000m Firmware » Version: N/A
cpe:2.3:o:nvidia:quadro_m1000m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Quadro M1000m » Version: N/A
Nvidia » Quadro M1200m Firmware » Version: N/A
cpe:2.3:o:nvidia:quadro_m1200m_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Quadro M1200m » Version: N/A
Nvidia » Grid M30 Firmware » Version: N/A
cpe:2.3:o:nvidia:grid_m30_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Grid M30 » Version: N/A
Nvidia » Grid M40 Firmware » Version: N/A
cpe:2.3:o:nvidia:grid_m40_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Nvidia » Grid M40 » Version: N/A

Vulnerability Details : CVE-2018-3979

Exploit prediction scoring system (EPSS) score for CVE-2018-3979

CVSS scores for CVE-2018-3979

CWE ids for CVE-2018-3979

References for CVE-2018-3979

Products affected by CVE-2018-3979