Guru3D.com
  • HOME
  • NEWS
    • Channels
    • Archive
  • DOWNLOADS
    • New Downloads
    • Categories
    • Archive
  • GAME REVIEWS
  • ARTICLES
    • Rig of the Month
    • Join ROTM
    • PC Buyers Guide
    • Guru3D VGA Charts
    • Editorials
    • Dated content
  • HARDWARE REVIEWS
    • Videocards
    • Processors
    • Audio
    • Motherboards
    • Memory and Flash
    • SSD Storage
    • Chassis
    • Media Players
    • Power Supply
    • Laptop and Mobile
    • Smartphone
    • Networking
    • Keyboard Mouse
    • Cooling
    • Search articles
    • Knowledgebase
    • More Categories
  • FORUMS
  • NEWSLETTER
  • CONTACT

New Reviews
MS Flight Simulator (2020): the 2021 PC graphics performance benchmark review
Radeon Series RX 6700 XT preview & analysis
Corsair MM700 & Corsair Katar Pro XT Review
Guru3D Rig of the Month - February 2021
ASUS GeForce RTX 3060 STRIX Gaming OC review
EVGA GeForce RTX 3060 XC Gaming review
MSI GeForce RTX 3060 Gaming X TRIO review
PALIT GeForce RTX 3060 DUAL OC review
ZOTAC GeForce RTX 3060 AMP WHITE review
Fractal Design Meshify 2 Compact chassis review

New Downloads
GeForce 461.81 hotfix driver download
ClockTuner for Ryzen (CTR) v2.0 RC4 Download
SiSoft Sandra 20/21 download v31.12
Intel HD graphics Driver Download Version: DCH 27.20.100.9316
AIDA64 Download Version 6.32.5644 beta
FurMark Download v1.25
MSI Afterburner 4.6.3 Final Stable Download
Display Driver Uninstaller Download version 18.0.3.7
Guru3D RTSS Rivatuner Statistics Server Download 7.3.0 Final
Media Player Classic - Home Cinema v1.9.10 Download


New Forum Topics
EU Rules that Microsoft can Purchase Bethesda More Rocket Lake-S Gaming Benchmarks leak small differences Only 11700K Retail Review Ryzen 5 3600 EPYC Gen 3 with Zen3 cores to be announced March 15th Nvidia maximum power settings (per game) sometimes doesn't work.3080 Driver 457.51 Vulkan Beta Driver GeForce Hotfix Driver Version 461.81 ClockTuner 2.0 for Ryzen (CTR) Guide and download 3080 tuf OC ed. Same stutter in apex once/twice a game (w/frametimegraph)




Guru3D.com » News » Vulnerability detected in NVIDIA display driver service

Vulnerability detected in NVIDIA display driver service

by Hilbert Hagedoorn on: 12/27/2012 07:37 AM | source: | 3 comment(s)
Vulnerability detected in NVIDIA display driver service

A hacker called Peter Winter-Smith discovered a security hole in NVIDIA's display driver service that allows local and remote users (Windows firewall/file sharing permitting) to gain administrator privileges in Windows via a stack buffer overflow.


Mr. Winter-Smith posted a description and details of the exploit, in which he describes the NVIDIA Display Device server (NVVSVC) as listening on a pipe (a means by which different processes talk to each other) "pipensvr," which has an null/empty discretionary access control list (DACL, a security whitelist for users/groups), letting ordinary logged in local and remote users (firewall permitting, and the remote admin has a local account) to gain administrator rights to the system.







« AMD FX-8300 95W TDP CPU released this week · Vulnerability detected in NVIDIA display driver service · ASUS planning $149 7-inch tablet »

Related Stories

Samsung smartphones and tablets vulnerable to kernel attack - 12/18/2012 09:18 AM
ZD Net reports a wide range of Samsung smartphones and tablets with the company's Exynos 4412 and 4210 ARM-based processors are vulnerable to an attack that enables hackers to obtain root access on a...

Steam Security Vulnerability Found when Using Certain Browsers - 10/18/2012 05:45 AM
Steam Security Vulnerability Found when Using Certain Browsers. Some browsers will execute the steam:// protocol without so much as a single prompt to the user

Wi-Fi Protected Setup PIN Brute Force Vulnerability - 12/30/2011 12:38 PM
A researcher has discovered a security hole in WPS technology that affects millions of Wi-Fi routers around the world. A few weeks ago I decided to take a look at the Wi-Fi Protected Setup (WPS) techn...

ASUS's Wireless-N Gigabit Router RT-N56U is vulnerable - 08/30/2011 01:02 PM
If you purchased one, be on alert and upgrade to the latest firmware. ASUS's Wireless-N Gigabit Router RT-N56U contains a vulnerability which may allow a remote unauthenticated attacker to recover th...

Microsoft to plug 11 vulnerabilities on Patch Tuesday - 04/10/2010 11:24 AM
Microsoft announced this month's Patch Tuesday will feature 11 security bulletins addressing 25 vulnerabilities in Windows and Office. For Windows there are five critical updates, three important upda...


Veeshush
Senior Member



Posts: 1095
Joined: 2010-11-28

#4488896 Posted on: 12/28/2012 07:01 PM
Surprised no one is really saying much about this. A few replies over at the nvidia forum: https://forums.geforce.com/default/topic/526419/geforce-drivers/security-exploit-found-nvidia-drivers/

Threat Post: http://threatpost.com/en_us/blogs/nvidia-display-driver-service-attack-escalates-privileges-windows-machines-122712

I want to say from the little bit I've read the average user wouldn't have much to worry about as long as they have a firewall up.

lucidus
Senior Member



Posts: 11825
Joined: 2011-12-31

#4488901 Posted on: 12/28/2012 07:06 PM
From what I understand only Enterprises are vulnerable provided the firewall rules are relaxed. Meh.

Noisiv
Senior Member



Posts: 7606
Joined: 2010-11-16

#4488962 Posted on: 12/28/2012 08:38 PM
How about Pro with UAC, software and hardware firewall, and Secondary Logon Service disabled :)

What pisses me off is that multi-billion $ company does not have a single person dedicated for informing the public in a fast and accurate manner.
But if I was guessing, I'd say that NVIDIA is publicly ignoring this due to a manner that the exploit has been disclosed.

Winter-Smith said he wanted to share the exploit in a timely fashion, rather than report it.

“I am definitely not averse to responsible disclosure and typically do follow a responsible disclosure process, however the risk from this particular flaw being exploited was (is) sufficiently low that I didn't think it would warrant the wait,” he said.

Post New Comment
Click here to post a comment for this news story on the message forum.


Guru3D.com © 2021