Cloudanix VulnDB

CVE-2021-1052

High · 7.8

CVSS

7.8

EPSS

0.4%

Published

Jan 8, 2021

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in NVIDIA graphics drivers on Windows and Linux lets people already on the computer interfere with the system or reach information they should not.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Privilege Gain
Component
OS kernel
Class
Privilege Escalation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits user-mode clients to invoke legacy privileged APIs through the kernel-mode nvlddmkm.sys handler for DxgkDdiEscape or related IOCTLs, bypassing normal access controls and enabling denial of service, privilege escalation, or information disclosure.

Why it matters to the business

Local attackers can crash systems, obtain elevated rights, or extract sensitive data, leading to operational disruption, unauthorized access, and potential follow-on attacks on affected Windows and Linux systems running NVIDIA GPU drivers.

How an attack unfolds

An attacker with local access on a system using the vulnerable NVIDIA driver crafts malicious calls to the DxgkDdiEscape or IOCTL handlers in nvlddmkm.sys to reach legacy privileged APIs and trigger the described impacts.

How to fix it

Update the NVIDIA GPU Display Driver for Windows and Linux to a patched version that restricts access to legacy privileged APIs in the kernel mode layer.

How to confirm the fix worked

Confirm the installed NVIDIA driver version is current, review kernel driver logs for restricted API access attempts, and test that user-mode clients can no longer reach the previously exposed legacy functions.

Typical attack path

  1. Gain local user access on a target system with the affected NVIDIA driver
  2. Identify the presence of nvlddmkm.sys and vulnerable driver version
  3. Craft and submit malicious DxgkDdiEscape or IOCTL requests to access legacy privileged APIs
  4. Trigger denial of service, escalate privileges, or disclose information

How to detect it

Examine Windows event logs and Linux kernel logs for repeated or anomalous calls involving nvlddmkm.sys, DxgkDdiEscape, or unexpected IOCTL patterns; correlate with privilege changes or service crashes.

  • nvlddmkm.sys
  • DxgkDdiEscape
  • unusual IOCTL requests to NVIDIA kernel driver

What your security team should do

  • Prioritize deployment of the latest NVIDIA GPU driver updates across all affected Windows and Linux systems
  • Limit local user privileges on systems with NVIDIA GPUs to reduce attack surface
  • Monitor kernel driver telemetry and system logs for anomalous DxgkDdiEscape or IOCTL activity

The record

NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape or IOCTL in which user-mode clients can access legacy privileged APIs, which may lead to denial of service, escalation of privileges, and information disclosure.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 nvidia-graphics-drivers 0 460.32.03-1
Debian:11 nvidia-graphics-drivers-tesla-450 0 450.102.04-1
Debian:12 nvidia-graphics-drivers 0 460.32.03-1
Debian:13 nvidia-graphics-drivers 0 460.32.03-1
Mageia:7 ldetect-lst 0 0.6.9.1-1.mga7
Mageia:7 nvidia-current 0 460.32.03-1.mga7.nonfree
Mageia:7 nvidia390 0 390.141-1.mga7.nonfree
Ubuntu:18.04:LTS linux 0 4.15.0-130.134
Ubuntu:18.04:LTS linux 0 4.15.0-134.138
Ubuntu:18.04:LTS linux-aws 0 4.15.0-1092.98
Ubuntu:18.04:LTS linux-aws-5.4 0 5.4.0-1035.37~18.04.1
Ubuntu:18.04:LTS linux-azure-4.15 0 4.15.0-1104.116
Ubuntu:18.04:LTS linux-azure-5.4 0 5.4.0-1036.38~18.04.1
Ubuntu:18.04:LTS linux-gcp-5.4 0 5.4.0-1034.37~18.04.1
Ubuntu:18.04:LTS linux-hwe-5.4 0 5.4.0-60.67~18.04.1
Ubuntu:18.04:LTS linux-hwe-5.4 0 5.4.0-64.72~18.04.1
Ubuntu:18.04:LTS linux-oracle 0 4.15.0-1063.70
Ubuntu:18.04:LTS linux-oracle-5.4 0 5.4.0-1035.38~18.04.1
Ubuntu:18.04:LTS nvidia-graphics-drivers-390 0 390.141-0ubuntu0.18.04.1
Ubuntu:18.04:LTS nvidia-graphics-drivers-418-server 0 418.181.07-0ubuntu0.18.04.1
Ubuntu:18.04:LTS nvidia-graphics-drivers-440-server 0 No fix
Ubuntu:18.04:LTS nvidia-graphics-drivers-450 0 450.102.04-0ubuntu0.18.04.1
Ubuntu:18.04:LTS nvidia-graphics-drivers-450-server 0 450.102.04-0ubuntu0.18.04.1
Ubuntu:18.04:LTS nvidia-graphics-drivers-455 0 No fix
Ubuntu:18.04:LTS nvidia-graphics-drivers-460 0 460.32.03-0ubuntu0.18.04.1
Ubuntu:20.04:LTS linux 0 5.4.0-60.67
Ubuntu:20.04:LTS linux 0 5.4.0-64.72
Ubuntu:20.04:LTS linux-aws 0 5.4.0-1035.37
Ubuntu:20.04:LTS linux-azure 0 5.4.0-1036.38
Ubuntu:20.04:LTS linux-gcp 0 5.4.0-1034.37
Ubuntu:20.04:LTS linux-hwe-5.8 0 5.8.0-36.40~20.04.1
Ubuntu:20.04:LTS linux-hwe-5.8 0 5.8.0-40.45~20.04.1
Ubuntu:20.04:LTS linux-oem-5.6 0 5.6.0-1042.46
Ubuntu:20.04:LTS linux-oracle 0 5.4.0-1035.38
Ubuntu:20.04:LTS nvidia-graphics-drivers-390 0 390.141-0ubuntu0.20.04.1
Ubuntu:20.04:LTS nvidia-graphics-drivers-418-server 0 418.181.07-0ubuntu0.20.04.1
Ubuntu:20.04:LTS nvidia-graphics-drivers-440-server 0 No fix
Ubuntu:20.04:LTS nvidia-graphics-drivers-450 0 450.102.04-0ubuntu0.20.04.1
Ubuntu:20.04:LTS nvidia-graphics-drivers-450-server 0 450.102.04-0ubuntu0.20.04.1
Ubuntu:20.04:LTS nvidia-graphics-drivers-455 0 No fix
Ubuntu:20.04:LTS nvidia-graphics-drivers-460 0 460.32.03-0ubuntu0.20.04.1
Ubuntu:Pro:18.04:LTS nvidia-graphics-drivers-440-server 0 No fix
Ubuntu:Pro:18.04:LTS nvidia-graphics-drivers-455 0 No fix
Ubuntu:Pro:20.04:LTS nvidia-graphics-drivers-440-server 0 No fix
Ubuntu:Pro:20.04:LTS nvidia-graphics-drivers-455 0 No fix

Related vulnerabilities