CVE-2022-31616

What it actually does

A local user with basic privileges can invoke the DxgkDdiEscape handler in nvlddmkm.sys to trigger an out-of-bounds read in kernel memory, resulting in denial of service or disclosure of kernel data.

Why it matters to the business

Systems using the affected driver may experience unexpected crashes or exposure of sensitive information, increasing operational downtime and compliance risks on Windows workstations and servers with NVIDIA GPUs.

How an attack unfolds

An attacker with local access on a Windows system crafts input to the DxgkDdiEscape interface in the NVIDIA kernel driver, causing the driver to read memory outside intended bounds and either crash the system or leak kernel contents.

How to fix it

Install the latest NVIDIA GPU Display Driver that resolves the out-of-bounds read condition in the nvlddmkm.sys DxgkDdiEscape handler.

How to confirm the fix worked

Confirm the installed NVIDIA driver version is newer than the vulnerable release, review release notes for the fix, and test that DxgkDdiEscape calls no longer produce out-of-bounds behavior under local privilege.

Typical attack path

1. Obtain local user access on a target Windows system running a vulnerable NVIDIA GPU driver
2. Locate and prepare a call to the DxgkDdiEscape handler
3. Supply malformed parameters to induce out-of-bounds memory access
4. Observe resulting kernel crash for denial of service or capture disclosed kernel data

How to detect it

Review Windows system and kernel logs for repeated nvlddmkm.sys faults or unexpected process terminations tied to graphics driver activity; correlate with local user sessions initiating escape calls.

What your security team should do

• Apply updated NVIDIA drivers across all Windows endpoints with GPU hardware
• Restrict local user privileges where possible to limit exposure
• Monitor kernel event logs for nvlddmkm.sys crashes