High severity · published Aug 5, 2022
CVE-2022-31609
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest is not authorized
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest is not authorized. This vulnerability may lead to loss of data integrity and confidentiality, denial of service, or information disclosure.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NV
NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming · NVIDIA
vGPU version 14.x (prior to 14.2), version 13.x (prior to 13.4) and version 11.x (prior 11.9). · source: vendor
VG
Virtual Gpu · Nvidia
11.0 before 11.8; 13.0 before 13.3; 14.0; 14.1 · source: NVD
Affected product
NV
NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming
NVIDIA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31609
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31609
Patch
https://nvidia.custhelp.com/app/answers/detail/a_id/5383
More from NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming
7.8
CVE-2022-31614
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it may double-free some resources
5.5
CVE-2022-31618
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a null pointer, which may lead to denial of service