image
Nvidia has issued fixes for high-severity flaws in two popular gaming products, including its graphics driver for Windows and GeForce Experience. The flaws can be exploited to launch an array of malicious attacks – from denial-of-service efforts (DoS) to escalation of privileges. The majority of the high-severity flaws are in the Windows GPU Display Driver, Nvidia’s graphics driver used in devices targeted to enthusiast gamers. This is the software component that enables the device’s operating system and programs to use its high-level graphics hardware. The driver has three high-severity flaws (CVE‑2019‑5690, CVE‑2019‑5691, CVE‑2019‑5692), which all stem from the kernel mode layer handler component of the driver, Nvidia said on Wednesday. Kernel mode is generally reserved for the lowest-level, most trusted functions of the operating system; in this case, the layer handler (nvlddmkm.sys) for the DxgkDdiEscape interface within the kernel mode has an array of glitches. These issues include the handler not validating the size of an input buffer (CVE‑2019‑5690), derefencing a NULL pointer (CVE‑2019‑5691) and using untrusted input when calculating an array index (CVE‑2019‑5692). All of these issues could enable escalation of privileges or DoS. These flaws are strikingly similar to high-severity vulnerabilities reported by Nvidia in May 2019, which also existed in the DxgkDdiEscape interface within the kernel mode layer of the driver. Those flaws could have led to information…

Source