CVE-2022-31616 : NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mod

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to denial of service, or information disclosure.

Published 2022-11-19 00:15:27

Updated 2022-11-29 15:26:45

Source NVIDIA Corporation

View at NVD, CVE.org

Vulnerability category: Input validationDenial of serviceInformation leak

Products affected by CVE-2022-31616

Nvidia » Gpu Display Driver » For Windows
Versions from including (>=) 511.09 and before (<) 513.46
cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:windows:*:*
Matching versions
When used together with: Nvidia » Studio » Version: N/A
Nvidia » Gpu Display Driver » For Windows
Versions from including (>=) 516.25 and before (<) 516.94
cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:windows:*:*
Matching versions
When used together with: Nvidia » Geforce » Version: N/A
Nvidia » Gpu Display Driver » For Windows
Versions from including (>=) 471.11 and before (<) 473.81
cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:windows:*:*
Matching versions
When used together with: Nvidia » Geforce » Version: N/A
Nvidia » Gpu Display Driver » For Windows
Versions from including (>=) 451.48 and before (<) 453.64
cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:windows:*:*
Matching versions
When used together with: Nvidia » Tesla » Version: N/A
Nvidia » Gpu Display Driver » For Windows
Versions from including (>=) 471.11 and before (<) 472.81
cpe:2.3:a:nvidia:gpu_display_driver:*:*:*:*:*:windows:*:*
Matching versions
When used together with: Nvidia » Tesla » Version: N/A
Nvidia » Virtual Gpu
Versions from including (>=) 11.0 and before (<) 11.8
cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Nvidia » Virtual Gpu
Versions from including (>=) 13.0 and before (<) 13.3
cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Nvidia » Virtual Gpu » Version: 14.0
cpe:2.3:a:nvidia:virtual_gpu:14.0:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A
Nvidia » Cloud Gaming Guest
Versions before (<) 516.94
cpe:2.3:a:nvidia:cloud_gaming_guest:*:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-31616

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-31616

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	1.8	5.2	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High
6.1	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H	1.8	4.2	NVIDIA Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: High

CWE ids for CVE-2022-31616

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: psirt@nvidia.com (Secondary)
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-31616

https://nvidia.custhelp.com/app/answers/detail/a_id/5383

Security Bulletin: NVIDIA GPU Display Driver - August 2022 | NVIDIA
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-31616

Products affected by CVE-2022-31616

Exploit prediction scoring system (EPSS) score for CVE-2022-31616

CVSS scores for CVE-2022-31616

CWE ids for CVE-2022-31616

References for CVE-2022-31616