Critical Vulnerabilities in linux-nvidia and linux-nvidia-lowlatency Packages
Summary
USN-7005-1: linux-nvidia, linux-nvidia-lowlatency vulnerabilities. Affects linux-nvidia versions < 6.8.0-1013.14. Fixed in 6.8.0-1013.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux-nvidia and linux-nvidia-lowlatency packages are essential components of the Ubuntu operating system, specifically designed to provide support for NVIDIA graphics hardware. These packages include kernel modules, headers, and tools necessary for the proper functioning of NVIDIA drivers on Ubuntu systems. The packages are crucial for users who rely on NVIDIA GPUs for graphical processing, gaming, and other compute-intensive tasks. However, recent vulnerabilities have been identified that could potentially compromise system security and stability.
Vulnerability Detail
Two significant vulnerabilities have been discovered in the linux-nvidia and linux-nvidia-lowlatency packages. The first vulnerability, identified as CVE-2024-23848, is a use-after-free issue in the CEC driver of the Linux kernel, which could allow a local attacker to cause a denial of service or execute arbitrary code. The second vulnerability, CVE-2024-40902, pertains to an out-of-bounds read in the JFS file system, which could also lead to a denial of service. These vulnerabilities stem from flaws in the kernel's handling of various subsystems, including architecture-specific drivers and file systems, making them critical to address.
How To Fix
Minimum fixed version
6.8.0-1013.14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-nvidiaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the affected kernel modules until they can apply the updates. This can be done by running the following commands in the terminal:
sudo modprobe -r nvidia
sudo modprobe -r nvidia-lowlatency
However, this may impact the performance of applications relying on NVIDIA graphics.
Conclusion
In summary, the linux-nvidia and linux-nvidia-lowlatency packages have critical vulnerabilities that could severely impact system security and stability. It is essential for users to update their packages to the latest versions to mitigate these risks. Utilizing tools like Vulert can further enhance your ability to monitor and manage vulnerabilities in your software.
See every vulnerability recorded for linux-nvidia →
FAQ
Failure to address these vulnerabilities could lead to system crashes, unauthorized access, or arbitrary code execution by local attackers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
As of now, there are no publicly known exploits, but the vulnerabilities are critical and should be patched promptly to prevent potential attacks.
Yes, you can roll back to a previous version using the command: sudo apt install linux-nvidia=6.8.0-1012.13 linux-nvidia-lowlatency=6.8.0-1012.13, but this is not recommended as it may expose your system to other vulnerabilities.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. It provides real-time insights into vulnerabilities affecting your applications.
Related vulnerabilities
Recent vulnerabilities recorded for linux-nvidia.
