CVE-2022-42255

What it actually does

Out-of-bounds array access in the nvidia.ko kernel module allows local code to read or write beyond intended buffer bounds, resulting in kernel memory corruption that can cause denial of service, arbitrary information disclosure, or data tampering.

Why it matters to the business

Systems using affected NVIDIA GPU drivers on Linux may experience unexpected crashes, exposure of sensitive kernel data, or unauthorized modification of memory, increasing downtime and risk in virtualized and cloud environments where GPU acceleration is common.

How an attack unfolds

An attacker with local user access on a Linux system loads or interacts with the vulnerable nvidia.ko module through standard driver interfaces, supplying crafted parameters that trigger the out-of-bounds access to corrupt kernel structures or leak memory contents.

How to fix it

Replace the vulnerable NVIDIA GPU Display Driver with a version that corrects the out-of-bounds access in nvidia.ko; apply the update across all affected physical hosts and virtual machine guests including those running on Citrix Hypervisor, VMware vSphere, Red Hat KVM, and NVIDIA virtual GPU or cloud gaming deployments.

How to confirm the fix worked

Confirm the installed NVIDIA driver version is newer than the vulnerable release, verify the nvidia.ko module no longer contains the reported array access flaw via driver release notes, and test that GPU-accelerated workloads continue without kernel oops or memory corruption under load.

Typical attack path

1. Obtain local shell or process execution on a Linux host with the vulnerable NVIDIA driver loaded
2. Identify or create a process that can issue IOCTL or other kernel calls to nvidia.ko
3. Craft input parameters that exceed array bounds in the kernel mode layer
4. Trigger the access to achieve memory corruption, disclosure, or denial of service

How to detect it

Review kernel logs for oops or panic messages referencing nvidia.ko, monitor for unexpected process crashes involving GPU workloads, and inspect audit logs for unusual ioctl activity targeting the NVIDIA device nodes.

What your security team should do

• Prioritize patching NVIDIA drivers on all Linux systems within 30 days given the high local impact and broad virtualization ecosystem exposure
• Inventory hosts running nvidia.ko and schedule staged rollouts starting with internet-facing or high-value VMs
• Monitor NVIDIA security bulletins for the exact fixed driver versions applicable to each product line
• Restrict unprivileged local access where feasible until updates are complete