CVE-2019-5688 Privilege escalation in NVIDIA NVFlash, NVUFlash, GPUModeSwitch Tool
Administrative users can access unauthorized device memory and registers via NVIDIA GPU tools, leading to privilege escalation, data leaks, or system crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5688?
CVE-2019-5688 is a medium-severity vulnerability in NVIDIA NVFlash, NVUFlash, GPUModeSwitch Tool, published on 18 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) contains a vulnerability in which authenticated users with administrative privileges can gain access to device memory and registers of other devices not managed by NVIDIA, which may lead to escalation of privileges, information disclosure, or denial of service.
Which versions are affected by CVE-2019-5688?
It affects 3 products.
Products include Nvidia Gpumodeswitch, Nvidia Nvflash, Nvidia Nvuflash.
How do I fix CVE-2019-5688?
No fix has been published for CVE-2019-5688 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-5688 being exploited?
There is no known exploitation of CVE-2019-5688 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-f2mm-3963-gx7q.