x11-drivers/nvidia-drivers-535.309.01

▸ GLSA 202505-04 NVIDIA Drivers: Multiple Vulnerabilities this version unaffected high local 2025-05-12

Multiple vulnerabilities have been discovered in NVIDIA Drivers, the worst of which could result in arbitrary code execution.

Announced: 2025-05-12
Revised: 2025-05-12
Access: local
Bugs: #954339
Advisory: https://security.gentoo.org/glsa/202505-04

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	< 535.247.01, < 550.163.01, < 570.133.07	>= 535.247.01, >= 550.163.01, >= 570.133.07

Background

NVIDIA Drivers are NVIDIA's accelerated graphics driver.

Description

A vulnerability has been discovered in NVIDIA Drivers. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifier for details.

Workaround

There is no known workaround at this time.

Resolution

All NVIDIA Drivers 535 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-535.247.01:0/535"

All NVIDIA Drivers 550 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-550.163.01:0/550"

All NVIDIA Drivers 570 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-570.133.07:0/570"

References

CVE-2025-23244

▸ GLSA 202412-20 NVIDIA Drivers: Privilege Escalation this version unaffected high local 2024-12-14

Multiple vulnerabilities have been discovered in NVIDIA Drivers, the worst of which could result in privilege escalation.

Announced: 2024-12-14
Revised: 2024-12-14
Access: local
Bugs: #942031
Advisory: https://security.gentoo.org/glsa/202412-20

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	< 535.216.01, < 550.127.05	>= 535.216.01, >= 550.127.05

Background

NVIDIA Drivers are NVIDIA's accelerated graphics driver.

Description

A vulnerability has been discovered in NVIDIA Drivers. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifier for details.

Workaround

There is no known workaround at this time.

Resolution

All NVIDIA Drivers 535 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-535.216.01:0/535"

All NVIDIA Drivers 550 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-550.127.05:0/550"

References

CVE-2024-0126

▸ GLSA 202405-28 NVIDIA Drivers: Multiple Vulnerabilities this version unaffected normal remote 2024-05-08

Multiple vulnerabilities have been discovered in NVIDIA Drivers, the worst of which could result in root privilege escalation.

Announced: 2024-05-08
Revised: 2024-05-08
Access: remote
Bugs: #909226 #916583
Advisory: https://security.gentoo.org/glsa/202405-28

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	< 470.223.02, < 525.147.05, < 535.129.03	>= 470.223.02, >= 525.147.05, >= 535.129.03

Background

NVIDIA Drivers are NVIDIA's accelerated graphics driver.

Description

Multiple vulnerabilities have been discovered in NVIDIA Drivers. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All NVIDIA Drivers 470 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-470.223.02:0/470"

All NVIDIA Drivers 525 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-525.147.05:0/525"

All NVIDIA Drivers 535 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-535.129.03:0/535"

References

▸ GLSA 202310-02 NVIDIA Drivers: Multiple Vulnerabilities this version unaffected normal remote 2023-10-03

Multiple vulnerabilities have been discovered in NVIDIA Drivers, the worst of which could result in root privilege escalation.

Announced: 2023-10-03
Revised: 2023-10-03
Access: remote
Bugs: #764512 #784596 #803389 #832867 #845063 #866527 #881341 #884045 #903614
Advisory: https://security.gentoo.org/glsa/202310-02

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	< 470.182.03, < 515.105.01, < 525.105.17, < 530.41.03	>= 470.182.03, >= 515.105.01, >= 525.105.17, >= 530.41.03

Background

NVIDIA Drivers are NVIDIA's accelerated graphics driver.

Description

Multiple vulnerabilities have been discovered in NVIDIA Drivers. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All NVIDIA Drivers 470 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-470.182.03:0/470"

All NVIDIA Drivers 515 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-515.105.01:0/515"

All NVIDIA Drivers 525 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-525.105.17:0/525"

All NVIDIA Drivers 530 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-530.41.03:0/530"

References

CVE-2021-1052
CVE-2021-1053
CVE-2021-1056
CVE‑2021‑1076
CVE‑2021‑1077
CVE-2021-1090
CVE-2021-1093
CVE-2021-1094
CVE-2021-1095
CVE‑2022‑21813
CVE‑2022‑21814
CVE-2022-28181
CVE-2022-28183
CVE-2022-28184
CVE-2022-28185
CVE-2022-31607
CVE-2022-31608
CVE-2022-31615
CVE‑2022‑34665
CVE-2022-34666
CVE-2022-34670
CVE-2022-34673
CVE-2022-34674
CVE-2022-34676
CVE-2022-34677
CVE-2022-34678
CVE-2022-34679
CVE-2022-34680
CVE-2022-34682
CVE-2022-34684
CVE-2022-42254
CVE-2022-42255
CVE-2022-42256
CVE-2022-42257
CVE-2022-42258
CVE-2022-42259
CVE-2022-42260
CVE-2022-42261
CVE-2022-42263
CVE-2022-42264
CVE-2022-42265
CVE-2023-0180
CVE-2023-0181
CVE-2023-0183
CVE-2023-0184
CVE-2023-0185
CVE-2023-0187
CVE-2023-0188
CVE-2023-0189
CVE-2023-0190
CVE-2023-0191
CVE-2023-0194
CVE-2023-0195
CVE-2023-0198
CVE-2023-0199

▸ GLSA 201402-02 NVIDIA Drivers: Privilege Escalation this version unaffected high local 2014-02-02

A NVIDIA drivers bug allows unprivileged user-mode software to access the GPU inappropriately, allowing for privilege escalation.

Announced: 2014-02-02
Revised: 2014-03-13 (revision 3)
Access: local
Bugs: #493448
Advisory: https://security.gentoo.org/glsa/201402-02

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	< 331.20	>= 331.20, >= 319.76 (revision), >= 304.116 (revision), >= 304.119 (revision), >= 304.121 (revision)

Background

The NVIDIA drivers provide X11 and GLX support for NVIDIA graphic boards.

Description

The vulnerability is caused due to the driver allowing unprivileged user-mode software to access the GPU.

Impact

A local attacker could gain escalated privileges.

Workaround

There is no known workaround at this time.

Resolution

All NVIDIA Drivers users using the 331 branch should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=x11-drivers/nvidia-drivers-331.20"

All NVIDIA Drivers users using the 319 branch should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=x11-drivers/nvidia-drivers-319.76"

All NVIDIA Drivers users using the 304 branch should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=x11-drivers/nvidia-drivers-304.116"

References

▸ GLSA 201304-01 NVIDIA Drivers: Privilege escalation this version unaffected high remote 2013-04-08

Two vulnerabilities in NVIDIA drivers may allow a local attacker to gain escalated privileges.

Announced: 2013-04-08
Revised: 2013-04-08
Access: remote
Bugs: #429614 #464248
Advisory: https://security.gentoo.org/glsa/201304-01

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	< 304.88	>= 304.88

Background

The NVIDIA drivers provide X11 and GLX support for NVIDIA graphic boards.

Description

Two vulnerabilities have been discovered in NVIDIA drivers:

A vulnerability has been found in the way NVIDIA drivers handle read/write access to GPU device nodes, allowing access to arbitrary system memory locations (CVE-2012-4225).
A buffer overflow error has been discovered in NVIDIA drivers (CVE-2013-0131).

NOTE: Exposure to CVE-2012-4225 is reduced in Gentoo due to 660 permissions being used on the GPU device nodes by default.

Impact

A local attacker could gain escalated privileges.

Workaround

There is no known workaround at this time.

Resolution

All NVIDIA driver users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=x11-drivers/nvidia-drivers-304.88"

References

▸ GLSA 201206-19 NVIDIA Drivers: Privilege escalation this version unaffected high local 2012-06-23

A vulnerability in NVIDIA drivers may allow a local attacker to gain escalated privileges.

Announced: 2012-06-23
Revised: 2012-06-23
Access: local
Bugs: #411617
Advisory: https://security.gentoo.org/glsa/201206-19

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	< 295.40	>= 295.40

Background

The NVIDIA drivers provide X11 and GLX support for NVIDIA graphic boards.

Description

A vulnerability has been found in the way NVIDIA drivers handle read/write access to GPU device nodes, allowing access to arbitrary system memory locations.

NOTE: Exposure to this vulnerability is reduced in Gentoo due to 660 permissions being used on the GPU device nodes by default.

Impact

A local attacker could gain escalated privileges.

Workaround

There is no known workaround at this time.

Resolution

All NVIDIA driver users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=x11-drivers/nvidia-drivers-295.40"

References

CVE-2012-0946

▸ GLSA 200708-14 NVIDIA drivers: Denial of service this version unaffected normal local 2007-08-19

A vulnerability has been discovered in the NVIDIA graphic drivers, allowing for a Denial of Service.

Announced: 2007-08-19
Revised: 2007-10-11 (revision 3)
Access: local
Bugs: #183567
Advisory: https://security.gentoo.org/glsa/200708-14

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	= 100.14.06	>= 71.86.01, >= 1.0.7185 (revision), >= 1.0.9639 (revision)

Background

The NVIDIA drivers provide support for NVIDIA graphic boards.

Description

Gregory Shikhman discovered that the default Gentoo setup of NVIDIA drivers creates the /dev/nvidia* with insecure file permissions.

Impact

A local attacker could send arbitrary values into the devices, possibly resulting in hardware damage on the graphic board or a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All NVIDIA drivers users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose "x11-drivers/nvidia-drivers"

References

CVE-2007-3532

▸ GLSA 200611-03 NVIDIA binary graphics driver: Privilege escalation vulnerability this version unaffected high remote, local 2006-11-07

The NVIDIA binary graphics driver is vulnerable to a local privilege escalation through an X session.

Announced: 2006-11-07
Revised: 2006-11-10 (revision 2)
Access: remote, local
Bugs: #151635
Advisory: https://security.gentoo.org/glsa/200611-03

Affected packages

Package	Arch	Vulnerable	Unaffected
x11-drivers/nvidia-drivers	*	< 1.0.8776	>= 1.0.8776, < 1.0.8762

Background

The NVIDIA binary graphics driver from NVIDIA Corporation provides the kernel module and the GL modules for graphic acceleration on the NVIDIA based graphic cards.

Description

Rapid7 reported a boundary error in the NVIDIA binary graphics driver that leads to a buffer overflow in the accelerated rendering functionality.

Impact

An X client could trigger the buffer overflow with a maliciously crafted series of glyphs. A remote attacker could also entice a user to open a specially crafted web page, document or X client that will trigger the buffer overflow. This could result in the execution of arbitrary code with root privileges or at least in the crash of the X server.

Workaround

Disable the accelerated rendering functionality in the Device section of xorg.conf :

Option      "RenderAccel" "false"

Resolution

NVIDIA binary graphics driver users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-1.0.8776"

References

CVE-2006-5379