Bug 948212 (CVE-2024-0131, CVE-2024-0147, CVE-2024-0149, CVE-2024-0150, CVE-2024-53869) – <x11-drivers/nvidia-drivers-{535.230.02:0/535,550.144.03:0/550}, x11-drivers/nvidia-drivers:0/565: multiple vulnerabilities

• Product: Gentoo Security
• Status: CONFIRMED ---

[Description Ionen Wolkens 2025-01-16 23:35:42 UTC]

NVIDIA's security page mentions that updates fix this for 0/570 (an unreleased branch), and has no fix for the ~arch-only 0/565.

That likely imply that the 0/565 "new feature branch" (NFB) is both affected and dead and a fix will have to wait until 0/570. Unfortunately it'd be difficult to mask it and make users downgrade given 0/565 has a lot of wayland improvements (lot of negative feedback last time tried this for 0/560 for bit different reasons).

~arch concerned users are free to downgrade to 0/550 manually if do not want to wait, while stable users will get the fixed version stabilized soon'ish

As usual 0/390, 0/470, and 0/vulkan are permanently masked with a security warning and not considered for these bugs.

TODO:
- stabilize 535.230.02:0/535 (in-tree) + cleanup old
- stabilize 550.144.03:0/550 (in-tree) + cleanup old
- wait for nvidia to release 0/570 and add it to the tree
- cleanup 0/565

---

CVE-2024-0150:
NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful exploit of this vulnerability might lead to information disclosure, denial of service, or data tampering.

CVE-2024-0147:
NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial of service or data tampering.

CVE-2024-53869:
NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability might lead to information disclosure.

CVE-2024-0131:
NVIDIA GPU kernel driver for Windows and Linux contains a vulnerability where a potential user-mode attacker could read  a buffer with an incorrect length. A successful exploit of this vulnerability might lead to denial of service.

CVE-2024-0149:
NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerability might lead to limited information disclosure.

[Comment 1 Larry the Git Cow 2025-01-21 15:33:18 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d94307152034a3d174f3c81ee99a106ee7221426

commit d94307152034a3d174f3c81ee99a106ee7221426
Author:     Ionen Wolkens <[e-mail]>
AuthorDate: 2025-01-21 15:10:27 +0000
Commit:     Ionen Wolkens <[e-mail]>
CommitDate: 2025-01-21 15:32:53 +0000

    x11-drivers/nvidia-drivers: drop vulnerable 535.216.01-r1, 550.142
    
    Affected 565.77 is still in tree due to still lacking a fixed
    version for that branch or newer.
    
    Bug: https://bugs.gentoo.org/948212
    Signed-off-by: Ionen Wolkens <[e-mail]>

 x11-drivers/nvidia-drivers/Manifest                |  16 -
 .../nvidia-drivers-565.57.01-kernel-6.12.patch     |  25 -
 .../nvidia-drivers-535.216.01-r1.ebuild            | 612 ---------------------
 .../nvidia-drivers/nvidia-drivers-550.142.ebuild   | 612 ---------------------
 4 files changed, 1265 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2e63fc66e750149a609cbe9e325d1dff66b9a239

commit 2e63fc66e750149a609cbe9e325d1dff66b9a239
Author:     Ionen Wolkens <[e-mail]>
AuthorDate: 2025-01-21 15:08:50 +0000
Commit:     Ionen Wolkens <[e-mail]>
CommitDate: 2025-01-21 15:32:52 +0000

    x11-drivers/nvidia-drivers: stabilize 535.230.02 for amd64
    
    Bug: https://bugs.gentoo.org/948212
    Signed-off-by: Ionen Wolkens <[e-mail]>

 x11-drivers/nvidia-drivers/nvidia-drivers-535.230.02.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c7eb7259330ba1a32ccf5980c9176e8e74357d8d

commit c7eb7259330ba1a32ccf5980c9176e8e74357d8d
Author:     Ionen Wolkens <[e-mail]>
AuthorDate: 2025-01-21 15:08:12 +0000
Commit:     Ionen Wolkens <[e-mail]>
CommitDate: 2025-01-21 15:32:52 +0000

    x11-drivers/nvidia-drivers: stabilize 550.144.03 for amd64
    
    Bug: https://bugs.gentoo.org/948212
    Signed-off-by: Ionen Wolkens <[e-mail]>

 x11-drivers/nvidia-drivers/nvidia-drivers-550.144.03.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[Comment 2 Ionen Wolkens 2025-01-26 16:05:27 UTC]

Apparently 570.86.10 "exists" but was pulled by nvidia. Mentions of R570 have also been removed from the security page.

There's talk that it may properly release on January 30th, but who knows.

[Comment 3 Larry the Git Cow 2025-01-30 16:33:31 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ec9b84a5c8ba327f67ecf360848c33dddec0a5d6

commit ec9b84a5c8ba327f67ecf360848c33dddec0a5d6
Author:     Ionen Wolkens <[e-mail]>
AuthorDate: 2025-01-30 16:09:17 +0000
Commit:     Ionen Wolkens <[e-mail]>
CommitDate: 2025-01-30 16:33:12 +0000

    x11-drivers/nvidia-drivers: add 570.86.16 (beta)
    
    Adding keyworded despite beta due for being needed
    for several reasons (on top of the two bugs).
    
    Bug: https://bugs.gentoo.org/948212
    Closes: https://bugs.gentoo.org/948478
    Signed-off-by: Ionen Wolkens <[e-mail]>

 x11-drivers/nvidia-drivers/Manifest                |   8 +
 x11-drivers/nvidia-drivers/files/nvidia-570.conf   |  45 ++
 .../nvidia-drivers/nvidia-drivers-570.86.16.ebuild | 606 +++++++++++++++++++++
 3 files changed, 659 insertions(+)

[Comment 4 Ionen Wolkens 2025-01-30 16:42:17 UTC]

All that's left here is cleanup the 0/565 branch (nvidia-drivers-565.77) replaced by 0/570, albeit will wait a bit to see if it's calm given new branches tend to come with regressions.

[Comment 5 Larry the Git Cow 2025-02-06 14:33:01 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=51d213d19112d3929611179b49d06534da276ae4

commit 51d213d19112d3929611179b49d06534da276ae4
Author:     Ionen Wolkens <[e-mail]>
AuthorDate: 2025-02-06 13:37:16 +0000
Commit:     Ionen Wolkens <[e-mail]>
CommitDate: 2025-02-06 14:32:23 +0000

    x11-drivers/nvidia-drivers: drop vulnerable 565.77
    
    If you have problems with the new 570 beta, I recommend going
    back to stable 550.x instead for now.
    
    Bug: https://bugs.gentoo.org/948212
    Signed-off-by: Ionen Wolkens <[e-mail]>

 x11-drivers/nvidia-drivers/Manifest                |   8 -
 x11-drivers/nvidia-drivers/files/nvidia-555.conf   |  44 --
 .../nvidia-drivers/nvidia-drivers-565.77.ebuild    | 589 ---------------------
 3 files changed, 641 deletions(-)