CVE-2022-31606

What it actually does

Failure to validate data in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape allows out-of-bounds access in kernel mode.

Why it matters to the business

Attackers with local access could crash systems, disclose sensitive information, escalate privileges or tamper with data on affected Windows systems using the vulnerable driver; the issue has been public for years with stable but low exploitation probability.

How an attack unfolds

A local attacker with basic user privileges crafts malicious input to the DxgkDdiEscape handler to trigger an out-of-bounds memory access and achieve denial of service, information disclosure, privilege escalation or data tampering.

How to fix it

Update affected NVIDIA GPU Display Driver packages to a fixed version; for star7th/showdoc (GIT) apply commit 818d7fe731f452acccacf731ce47ec27ad68049c.

How to confirm the fix worked

Confirm the installed driver version is newer than the vulnerable release and that the DxgkDdiEscape handler properly validates input lengths and offsets.

Typical attack path

1. Obtain local user access on a Windows system with the vulnerable NVIDIA driver
2. Invoke the DxgkDdiEscape escape call with malformed data
3. Trigger the out-of-bounds access to achieve the desired impact

How to detect it

Review system and driver logs for unexpected crashes or errors originating from nvlddmkm.sys around DxgkDdiEscape calls; examine memory dumps for out-of-bounds access patterns.

What your security team should do

• Apply the vendor-supplied driver update immediately on all Windows systems
• Restrict local user accounts where possible until patches are deployed
• Monitor for any new exploit code or increased EPSS scores