CVE-2022-31612

What it actually does

Out-of-bounds read in the kernel-mode nvlddmkm.sys handler for DxgkDdiEscape that permits a local user to trigger a system crash or disclose internal kernel memory.

Why it matters to the business

Systems with NVIDIA GPUs may experience unexpected blue-screen crashes that interrupt workloads or, in the worst case, expose sensitive kernel data that could aid further attacks; prevalence across consumer, professional, and virtualized GPU deployments increases the scope of potential downtime.

How an attack unfolds

An attacker with a local account on a Windows system that uses a vulnerable NVIDIA driver crafts a malicious DxgkDdiEscape call, sends it through the kernel interface, and reads memory outside the intended buffer bounds, either crashing the system or leaking kernel information.

How to fix it

Upgrade the NVIDIA GPU Display Driver to the latest version that resolves CVE-2022-31612; apply the update through NVIDIA's driver download site or enterprise management tools and reboot the system.

How to confirm the fix worked

Verify the installed driver version against the fixed release notes; retest the DxgkDdiEscape path with boundary-checking tools or monitor for the absence of the previously reported crash or information-leak symptoms.

Typical attack path

1. Gain local user access on a Windows host with a vulnerable NVIDIA GPU driver
2. Load or interact with the nvlddmkm.sys driver via the DxgkDdiEscape interface
3. Supply a malformed input buffer that triggers the out-of-bounds read
4. Observe kernel crash or harvest leaked internal kernel data for further exploitation

How to detect it

Search Windows event logs and crash dumps for repeated nvlddmkm.sys faults; monitor for unusual local processes issuing large numbers of DxgkDdiEscape calls; correlate any kernel information disclosures with subsequent lateral movement attempts.

• nvlddmkm.sys
• DxgkDdiEscape

What your security team should do

• Immediately schedule driver updates on all affected Windows endpoints and virtual GPU instances
• Prioritize high-value or internet-facing workstations that host NVIDIA hardware
• Enable driver crash logging and review system event logs for nvlddmkm.sys faults
• Restrict local user privileges where feasible to reduce the attack surface