High severity · published Jun 25, 2020
CVE-2020-5964
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the service host component, in which the application resources integrity check may be missed
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the service host component, in which the application resources integrity check may be missed. Such an attack may lead to code execution, denial of service or information disclosure.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geforce Experience · Nvidia
before 3.20.4 · source: NVD
GF
Geforce Firmware · Nvidia
450 before 451.48 · source: NVD
NF
Nvs Firmware · Nvidia
390 before 392.61; 418 before 426.78; 440 before 443.18; 450 before 451.48 · source: NVD
QF
Quadro Firmware · Nvidia
390 before 392.61; 418 before 426.78; 440 before 443.18; 450 before 451.48 · source: NVD
TF
Tesla Firmware · Nvidia
418 before 426.78; 440 before 443.18; 450 before 451.48 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5964
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5964
Vendor Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5031
Vendor Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5038
More from Geforce Experience
9.8
CVE-2017-14491
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response
8.8
CVE-2017-6250
NVIDIA GeForce Experience contains a vulnerability in NVIDIA Web Helper.exe, where untrusted script execution may lead to violation of application execution policy and local code…
8.8
CVE-2016-8812
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before GFE 3.1.0.52 contains a vulnerability in the kernel mode…
8.3
CVE-2021-1073
NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any…
8.2
CVE-2021-23175
NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device,…