CVE-2021-1056
📋 TL;DR
This vulnerability in NVIDIA GPU Display Driver for Linux allows attackers to bypass file system permissions on GPU devices, potentially leading to denial of service or information disclosure. It affects all versions of the driver on Linux systems where NVIDIA GPUs are present. The issue resides in the kernel mode layer (nvidia.ko) which fails to properly enforce OS-level isolation.
💻 Affected Systems
- NVIDIA GPU Display Driver for Linux
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker could gain unauthorized access to GPU memory, potentially exfiltrating sensitive data from other processes or causing system instability through GPU resource manipulation.
Likely Case
Local privilege escalation allowing unauthorized GPU access, potentially leading to information leakage between processes sharing the GPU or denial of service through GPU resource exhaustion.
If Mitigated
With proper access controls and isolation, impact is limited to local users with existing system access; remote exploitation would require prior local access.
🎯 Exploit Status
Exploitation requires local access to the system; no public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 470.86 or later
Vendor Advisory: https://nvidia.custhelp.com/app/answers/detail/a_id/5142
Restart Required: Yes
Instructions:
1. Download latest NVIDIA driver from official site 2. Stop display manager (e.g., sudo systemctl stop gdm) 3. Run NVIDIA installer with --silent flag 4. Reboot system
🔧 Temporary Workarounds
Restrict GPU device access
linuxSet strict permissions on GPU device files to limit access
sudo chmod 600 /dev/nvidia*
🧯 If You Can't Patch
- Implement strict access controls on /dev/nvidia* device files
- Isolate GPU workloads to trusted users only using cgroups or containers
🔍 How to Verify
Check if Vulnerable:
Check NVIDIA driver version: cat /proc/driver/nvidia/version | grep -i versionCheck Version:
cat /proc/driver/nvidia/versionVerify Fix Applied:
Verify driver version is 470.86 or higher: cat /proc/driver/nvidia/version📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /dev/nvidia* device files
- Kernel logs showing permission denied errors for GPU access
Network Indicators:
- None - local vulnerability only
SIEM Query:
source="/var/log/syslog" AND "nvidia" AND ("permission denied" OR "access denied")🔗 References
- https://lists.debian.org/debian-lts-announce/2022/01/msg00013.html
- https://nvidia.custhelp.com/app/answers/detail/a_id/5142
- https://security.gentoo.org/glsa/202310-02
- https://lists.debian.org/debian-lts-announce/2022/01/msg00013.html
- https://nvidia.custhelp.com/app/answers/detail/a_id/5142
- https://security.gentoo.org/glsa/202310-02
