CVE-2022-42263

Vulnerability

An integer overflow vulnerability exists in the kernel mode layer (KML) handler of the NVIDIA GPU Display Driver for Linux. The flaw occurs when processing certain requests, allowing an overflow that can corrupt memory. The affected versions include driver branches 470, 515, 525, and 530 prior to specific fixed releases [1].

Exploitation

An attacker with local access to the system can trigger the integer overflow by sending specially crafted inputs to the kernel mode driver. No special privileges are required beyond a local user account. The exploitation does not require user interaction beyond the attacker executing the malicious code [1].

Impact

Successful exploitation can lead to a denial of service (system crash) or information disclosure (potential leakage of sensitive data). The vulnerability does not appear to enable privilege escalation directly, but the information disclosure could aid further attacks [1].

Mitigation

NVIDIA has released updated drivers. For Gentoo Linux, users should upgrade to the following versions or later: nvidia-drivers-470.182.03 (470 branch), 515.105.01 (515 branch), 525.105.17 (525 branch), 530.41.03 (530 branch). No known workaround exists; applying the update is the only mitigation [1].