Mageia alert MGASA-2022-0285 (nvidia-current)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2022-0285: Updated nvidia-current packages fix security vulnerabilities
Date:
             
 
Thu, 18 Aug 2022 20:46:44 +0200
Message-ID:
             
 
<20220818184644.794DDA11B6@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2022-0285 - Updated nvidia-current packages fix security vulnerabilities

Publication date: 18 Aug 2022
URL: https://advisories.mageia.org/MGASA-2022-0285.html
Type: security
Affected Mageia releases: 8
CVE: CVE‑2022‑31607,
     CVE‑2022‑31608,
     CVE‑2022‑31615,
     CVE‑2022‑34665,
     CVE‑2022‑34666

Description:
Updated nvidia-current packages fix security vulnerabilities:

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel
mode layer (nvidia.ko), where a local user with basic capabilities can cause
improper input validation, which may lead to denial of service, escalation
of privileges, data tampering, and limited information disclosure
(CVE‑2022‑31607).

NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional
D-Bus configuration file, where a local user with basic capabilities can
impact protected D-Bus endpoints, which may lead to code execution, denial
of service, escalation of privileges, information disclosure, and data
tampering (CVE‑2022‑31608).

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel
mode layer, where a local user with basic capabilities can cause a null-
pointer dereference, which may lead to denial of service (CVE‑2022‑31615).

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel
mode layer, where a local user with basic capabilities can cause a null-
pointer dereference, which may lead to denial of service (CVE‑2022‑34665).

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability
in the kernel mode layer, where a local user with basic capabilities can
cause a null-pointer dereference, which may lead to denial of service
(CVE‑2022‑34666).

References:
- https://bugs.mageia.org/show_bug.cgi?id=30722
- https://nvidia.custhelp.com/app/answers/detail/a_id/5383
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE‑2022‑3...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE‑2022‑3...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE‑2022‑3...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE‑2022‑3...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE‑2022‑3...

SRPMS:
- 8/core/ldetect-lst-0.6.26.13-1.mga8
- 8/nonfree/nvidia-current-470.141.03-1.mga8.nonfree