Looks like all Nvidia GPUs are vulnerable to an exploit.

Discussion in 'all things UNIX' started by SuperSapien, Dec 28, 2017.

  1. SuperSapien

    SuperSapien Registered Member

  2. Stupendous Man

    Stupendous Man Registered Member

    Vulnerabilities in NVIDIA products are reported quite often.
    See NVIDIA's Product Security page for a full overview.

    Regarding the mentioned Security Bulletin 4278, all vulnerabilities have Attack Vector: Local (AV:L).
    I don't worry about AV:L vulnerabilities. I think if an attacker has local access, there is much more to worry about than the vulnerabilities.
     
  3. SuperSapien

    SuperSapien Registered Member

    What about other vulnerabilities? Also whenever I surf the web I do it from a non-admin account with Firejail.
     
  4. Stupendous Man

    Stupendous Man Registered Member

    Exactly what do you mean, "What about other vulnerabilities?"
    Do you mean other vulnerabilities in NVIDIA products?
    As you can see in the overview on NVIDIA's Product Security page, a very few vulnerabilities had/have Attack Vector: Network (AV:N). It is wise to patch such (AV:N) vulnerabilities, if those apply to NVIDIA products that you use on your systems.
    In some cases other mitigations may be enough to eliminate a certain vulnerability (like, for instance, disabling remote desktop access, in some cases).
    See NVIDIA's Product Security bulletins for details about all vulnerabilities.
     
  5. SuperSapien

    SuperSapien Registered Member

    When you say disabling remote desktop access do you on my router or in my BIOS?:confused: Also would Firejail be considered a mitigation?
    I apologize I'm not that savvy with hardware and I'm still pretty much a greenhorn when it comes to Linux.
     
  6. Stupendous Man

    Stupendous Man Registered Member

    I'm sorry, SuperSapien, disabling remote desktop access was only an example of a mitigation for some vulnerabilities, and it was an example for Windows, not Linux. It doesn't apply to Linux. So it was a poorly chosen example, I'm very sorry about that. Sorry for the confusion.

    I don't know about the Linux distro that you are using, but as for Linux distros that I know, I suppose that if it had a vulnerable NVIDIA driver, a fixed version was offered automatically, so you wouldn't need to worry about that.
     
  7. SuperSapien

    SuperSapien Registered Member

    I'm using Linux KDE 17.2 and I believe I'm using the open source drivers for my Video Card.
     
  8. Stupendous Man

    Stupendous Man Registered Member

    Do you mean Linux Mint KDE 17.2?
    KDE is not the distribution, but the desktop environment.
    In case of Linux Mint KDE, Linux Mint is the distribution (distro), and KDE is the desktop environment (DE).

    I'm not sure, but I guess the vulnerabilities in NVIDIA drivers do not apply to the open source drivers.
    And as I mentioned before, I suppose that if your installation had a vulnerable graphics driver (NVIDIA or open source), a fixed version was offered automatically, so you wouldn't need to worry about that.
    Perhaps someone else can tell you for sure.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice