10 ms·
Security flaws found in Nvidia GeForce GPUs
- bpye 2y agoThe actual security bulletin is here - https://nvidia.custhelp.com/app/answers/detail/a_id/5586 https://nvidia.custhelp.com/app/answers/detail/a_id/5586 As it points out, this is an issue with the driver rather than the physical GPU.
- kmoser 2y agoI can't find anything on that page or https://nvidia.custhelp.com/app/answers/detail/a_id/5586#security-updates-for-nvidia-gpu-display-driver https://nvidia.custhelp.com/app/answers/detail/a_id/5586#sec... that describes whether Windows Update will update the drivers automatically. I just did a Windows Update and it's still got an NVIDIA display driver dated 3/9/2023.
- Toorkit 2y agoOn Windows you have to either download the driver updates manually, or install that GeForce Experience thing that keeps them up to date for you.
- esperent 2y agoThere's a third party utility program you can use, it notifies you of new versions and lets you skip installing a lot of the bloatware like GeForce. I think it's called NV Install.
- Dalewyn 2y agoGeForce Experience is optional. I can't fathom why people want to abstract something as simple as downloading the drivers straight from Nvidia and installing it, but then again people (perhaps rightfully) don't understand WTF a computer is.
- Dwedit 2y agoIn the past, GeForce Experience had game streaming functionality. Similar to VNC, but using hardware-accelerated video codecs, and supports joysticks and sound. GeForce Experience removed the game streaming feature in 2023, but the protocol was reverse-engineered, and there's compatible third-party tools for game streaming. Sunshine is the server, and Moonlight is the client. It works a lot better than Miracast.
- richardfey 2y agoIt was working also on devices like the Shield.
- KaoruAoiShiho 2y agoUmm no it didn't. The game streaming is still there and I use it literally every day to access my windows PCs from my macs.
- oefrha 2y agoI download drivers straight from nvidia.com and it takes many steps: go to drivers page, choose product series, choose product (choices don’t seem to matter but who knows if that’s gonna change at some point), click start search, click on the search result to go to driver page, click download, run installer, click click click click click. It’s a hassle compared to updating just about anything else on my machines. I only do it because (1) GeForce Experience requires logging in with Nvidia account and seems to log me out every time; (2) when GeForce Experience updates the driver it seems to pause forever doing god knows what between finishing the download and starting to install.
- Dalewyn 2y ago>(choices don’t seem to matter but who knows if that’s gonna change at some point) They do matter, you're just lucky(?) always using hardware and software environments that are always covered by the first thing on the list. If you don't want to specify details and run an installer, that's squarely a You problem.
- mrec 2y agoNVCleanInstall, maybe? I couldn't find anything called "NV Install". Personally I'm still running with the drivers that came with the box when I bought it in 2020. GeForce Experience is an abomination; besides the mind-boggling bloat, demanding that I create an account just to download a driver update really made me determined never to buy NVidia ever again.
- Hawxy 2y agoNo, Windows Update's Nvidia driver set is usually years out of date and rarely gets updated. It exists as an emergency fallback and doesn't push out regular updates.
- deleted 2y ago[deleted]
- baq 2y agoIt’s also likely nvidia keeps submitting the driver and it can’t pass the 'is this not crap' step of the process. Wouldn’t surprise me in the least.
- chrisjj 2y agoHow is this latest not an emergency, I wonder.
- kmoser 2y agoWhich begs the question: is Windows' NVIDIA driver even affected by this recent flaw? Because I don't use my PC to play games and thus don't need anything more than run-of-the-mill graphics acceleration, I'm loathe to download NVIDIA's enormous drivers, which I assume contain extraneous features and utilities that are useless to me.
- fulafel 2y agoA driver, to be even more correct.
- jamesy0ung 2y agoTo save a click, the release date of the updated driver (566.03) is 22/10/2024.
- ekianjo 2y agoYou could have added that the fixes for Linux are in versions 565.57.01, 550.127.05, and 535.216.01. Not everyone runs Windows.
- zamadatix 2y agoAs is always the case all throughout every year: https://www.nvidia.com/en-us/security/ https://www.nvidia.com/en-us/security/ (enter "GPU Display" in the search filter box)
- SoftTalker 2y agoGPU monoculture showed its downside.
- anonym29 2y ago"Take that, normies!" - Nouveau users tomorrow, after their framebuffer finishes loading
- geerlingguy 2y agos/after/if ;)
- ClassyJacket 2y agoOther than the 2000$ graphics cards?
- tedunangst 2y agoBecause gpu drivers were so much better when there were six vendors?
- Kon-Peki 2y agoWow, if you go to the Nvidia drivers website, they are still pushing the vulnerable 565.90 version as the "stable version" for creatives. It's only the gamer version that has been updated to 566.03 with the fixes. Incredible.
- weird-eye-issue 2y agoRelax buddy
- kbmr 2y agoLet's see if they recommend the fixed version by Monday or Tuesday at the latest
- exmadscientist 2y agoIt is widely believed that the two versions are completely identical, just on a different release cadence. The "Studio" version is also supposed to pass a wider set of tests, but it's still the same driver. The "Game" driver is really only important for newly released games needing fixes/patches/optimizations that just weren't available yet for the previous "Studio" driver release. At least, that seems to be the consensus among people who've tried to figure this out. There's no official word.
- Kon-Peki 2y agoThe fine print on the security notice page says that there is a 565.92 version that some OEMs are pushing out themselves. I get that there is a different release cadence, but it’s simply not acceptable to do business as normal surrounding security releases. The driver page should either have that 656.92 available or disable the download link for the stable channel with a note on when they expect it to be available again. At the very least, some product manager should be fired. This is a legal liability, and no amount of click-wrap disclaimers will protect them if someone gets owned because of this negligence.
- Melatonic 2y agoThe studio driver also opens up some functionality that the game driver does not.
- advisedwang 2y agoIf I'm reading the bulletin right, then all the issues can only be exploited from code already running on your machine. So if you have a single user machine and aren't already owned then this is a non-issue and the verbiage in the title and PC World article are not warranted. The people that actually need to update are: * Multi-user systems with some untrusted users. * Users with malware on their system already (which could privilege escalate) * virtualization hosts of untrusted guests.
- HellsMaddy 2y agoI wonder if it could be exploited via WebGL/WebGPU?
- ummonk 2y agoDoes that mean it cannot be exploited through WebGL?
- solardev 2y agoI wonder if this affects Geforce Now
- TazeTSchnitzel 2y agoIf you use a web browser or play multiplayer video games then there will be code running on your system that interacts with GPU drivers that you haven't explicitly chosen to download and which could potentially exploit certain vulnerabilities.
- smolder 2y agoThis highlights why we shouldn't let browsers (google) keep expanding their reach outside of the historical sandbox. It's almost like all the in-browser Java and Flash problems being repeated. They're creating security problems more than helping legitimate developers. WebGL was fine. Websockets were fine. WebGPU and the recently proposed arbitrary socket API are jumping the shark. Raw GPU access and TCP/UDP access are simply bad ideas from inexperienced people and need to be shut down. If you truly need that stuff I think the solution is to step up your game and make native applications.
- rubicks 2y agoTimes like this really bolster my distrust and hatred for those horrible dkms installers. Thank you, nvidia, for living up to my worst expectations.
- DowsingSpoon 2y agohttps://nvidia.custhelp.com/app/answers/detail/a_id/5586 https://nvidia.custhelp.com/app/answers/detail/a_id/5586 >NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering What does “privileged attacker” mean on Linux? In my mind, “privileged” would mean they already have root, but in that case there’s nothing to escalate, right?
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- helsinkiandrew 2y agoPresumably it needs to be run by someone who already has access to the computer and gives them (or a program executed by them) root/escalated privileges. Although that might include running code from a webpage etc.
- hiddencost 2y agoIncluding an advertiser on a webpage.
- l33tman 2y agoWondering the same. The same column lists a bunch of Windows-only CVEs where an unprivileged user can do stuff, so there has to be some difference between those (CVE‑2024‑0117 - CVE‑2024‑0121) and the headliner CVE‑2024‑0126 They mention hypervisor breaches further below, so could the CVE 0126 imply that a local root user on a shared GPU machine of some sort can break out of the virtualization?
- Dwedit 2y agoNVIDIA's website lists 566.03 as the newest "Game Ready" driver, and 565.90 as the newest "Studio" driver. Does the Studio driver contain the security fix as well?
- exmadscientist 2y agoNo. The hotfix is in v566 or later. The "Game" and "Studio" drivers are widely believed to be from one codebase, just released on different schedules and with a larger test suite for the "Studio" driver. So you have your choice of hotfix-without-testing or tested-without-hotfix!
- Muromec 2y agoWhy is their versioning scheme follow based on a stock price and not normie numbers?
- deleted 2y ago[deleted]
- Springtime 2y agoLooks like their manual driver search model dropdown only goes back to the Turing generation (20 series). Edit: found the Windows driver[1] directly via an online search which covers older models, too. [1] https://www.nvidia.com/download/driverResults.aspx/235774/ https://www.nvidia.com/download/driverResults.aspx/235774/
- Uptrenda 2y agoThat's going to effect a lot of computers. This family of GPUs is incredibly popular. Many of my own graphics cards are GeForce :/
- 20after4 2y agoNo update is currently available for Debian¹. This vulnerability is marked as "low priority"² for Bookworm. 1. https://security-tracker.debian.org/tracker/source-package/nvidia-graphics-drivers https://security-tracker.debian.org/tracker/source-package/n... 2. https://tracker.debian.org/pkg/nvidia-graphics-drivers https://tracker.debian.org/pkg/nvidia-graphics-drivers
- fulafel 2y agoWorth noting that the non-free repos are not a part of Debian and don't get security support. The free Nvidia driver is not affected.
- pjmlp 2y agoMost of them are our out of bounds memory corruption friends, which everyone keeps telling it is not an issue on their C and C++ code, only happens to others.
- givinguflac 2y agoOh good, historically Nvidia drivers on Linux are just… chef’s kiss. Hopefully this will improve things /s.
- thn-gap 2y agoThis just reminded me that the GeForce Experience (which is recommended to use the recording functions, and keep updating the drivers), requires an account. And the software is unable to keep your account logged in. It's outrageous to pay so much for a graphics card to later have this experience.
- iamateapot 2y agoThe NVIDIA App (beta), which, as I understand it, combines the GeForce Experience and the Control Panel doesn't require the login (for now?): https://www.nvidia.com/en-us/software/nvidia-app/ https://www.nvidia.com/en-us/software/nvidia-app/ https://arstechnica.com/gaming/2024/02/nvidias-new-app-doesnt-require-you-to-log-in-to-update-your-gpu-driver https://arstechnica.com/gaming/2024/02/nvidias-new-app-doesn...
- xyst 2y agoI already have kernel level root kits installed for multiplayer games. This privilege escalation exploit is child’s play.
- yupyupyups 2y agoEven if I still liked playing multiplayer games, I would never (willingly) install a rootkit.
- deleted 2y ago[deleted]
- 2OEH8eoCRo0 2y agoHow's that webgpu or webassembly working out?
- vtodekl 2y ago[dead]