CVE-2020-5969 Race condition in NVIDIA vGPU Software

What is CVE-2020-5969?

CVE-2020-5969 is a medium-severity vulnerability in NVIDIA vGPU Software, published on 30 Jun 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which it validates a shared resource before using it, creating a race condition which may lead to denial of service or information disclosure. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3).

Weakness: CWE-362

Which versions are affected by CVE-2020-5969?

It affects 1 product.

Products include Nvidia Virtual Gpu Manager.

How do I fix CVE-2020-5969?

No fix has been published for CVE-2020-5969 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-5969 being exploited?

There is no known exploitation of CVE-2020-5969 in the wild and no public exploit code.

Other vulnerabilities in NVIDIA vGPU Software

• CVE-2021-1080 Other in NVIDIA Virtual GPU Software High 7.8
• CVE-2021-1081 Other in NVIDIA Virtual GPU Software High 7.8
• CVE-2021-1082 Other in NVIDIA Virtual GPU Software High 7.8
• CVE-2021-1083 Other in NVIDIA Virtual GPU Software High 7.8
• CVE-2021-1084 Other in NVIDIA Virtual GPU Software High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c4h4-r8fr-pc26.