High severity · published Dec 30, 2022
CVE-2022-42261
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun, which in turn may cause data tampering, information disclosure, or denial of service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CG
Cloud Gaming · Nvidia
before 525.60.12 · source: NVD
GD
Gpu Display Driver · Nvidia
470 before 470.161.03; 510 before 510.108.03; 450 before 450.216.04; 470 before 470.161.03; 510 before 510.108.03 · source: NVD
VG
Virtual Gpu · Nvidia
before 11.11; 12.0 before 13.6; 14.0 before 14.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-42261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-42261
Vendor Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5415
Third Party Advisory
https://security.gentoo.org/glsa/202310-02
More from Cloud Gaming
7.8
CVE-2024-0107
NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read
7.8
CVE-2024-0091
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API
7.8
CVE-2024-0090
NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds write
7.8
CVE-2024-0089
NVIDIA GPU Display Driver for Windows contains a vulnerability where the information from a previous client or another process could be disclosed
7.8
CVE-2024-0085
NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host