NVIDIA received notification of a security exploit that uses NVIDIA UNIX device files to map and program registers to redirect the VGA window. Through the VGA window, the exploit can access any region of physical system memory. This arbitrary memory access can be further exploited, for example, to escalate user privileges. Because any user with read and write access to the NVIDIA device files (which is needed to execute applications that use the GPU) could potentially exploit this vulnerability to gain access to arbitrary system memory, this vulnerability is classified as high risk by NVIDIA. NVIDIA is resolving this problem by blocking user-space access to registers that control redirection of the VGA window. Further, NVIDIA is also blocking user-space access to registers that control GPU-internal microcontrollers, which could be used to achieve a similar exploit. NVIDIA is committed to security and is working on more robust solutions to prevent malicious manipulations of GPUs. NVIDIA has released updated UNIX graphics drivers 295.71 and 304.32, which contain the fix.
In related news: *nvidia-drivers-302.17-r1 (05 Aug 2012) *nvidia-drivers-295.59-r1 (05 Aug 2012) 05 Aug 2012; Doug Goldstein <cardoe@gentoo.org> +files/nvidia-blacklist-vga-pmu-registers-256-304.diff, +nvidia-drivers-295.59-r1.ebuild, -nvidia-drivers-302.17.ebuild, +nvidia-drivers-302.17-r1.ebuild: Fix CVE-2012-xxxx. With access to /dev/nvidia* a malicious user could exploit the VGA window size to read/write from kernel memory and gain root access.
*** This bug has been marked as a duplicate of bug 429614 ***
Oh right. Maintainers weren't CC'd then.
