CVE-2023-52642

What it actually does

The flaw permitted BPF attach and detach operations on remote control (RC) devices without requiring write permission on the device, bypassing an intended authorization check (while still needing CAP_NET_ADMIN).

Why it matters to the business

Local users could perform unauthorized modifications to RC device handling, potentially leading to privilege escalation or interference with media subsystems on affected Nvidia driver packages; low urgency due to absence from known exploitation lists and minimal exploit probability.

How an attack unfolds

An attacker with local access but lacking write permission on an RC device node invokes BPF attach or detach operations; the missing permission check allows the operation to succeed when only CAP_NET_ADMIN is held, enabling manipulation of device behavior.

How to fix it

Upgrade nvidia-graphics-drivers-390 to 390.151-0ubuntu0.18.04.1 (Ubuntu 18.04 LTS) or 390.151-0ubuntu0.20.04.1 (Ubuntu 20.04 LTS); upgrade nvidia-graphics-drivers-450-server to 450.191.01-0ubuntu0.18.04.1 (Ubuntu 18.04 LTS) or 450.191.01-0ubuntu0.20.04.1 (Ubuntu 20.04 LTS). Apply the corresponding kernel or driver package updates and reboot.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed releases using dpkg or apt; verify the permission check is present in the rc-core BPF handling code after update.

Typical attack path

1. Obtain local shell on an affected Ubuntu system with Nvidia graphics drivers installed
2. Locate an RC device node under /dev or /sys/class/rc
3. Invoke BPF attach or detach syscall or bpftool command against the device without possessing write permission
4. Leverage resulting device state change for further actions such as input injection or evasion

How to detect it

Review system logs for unexpected BPF program loads targeting RC subsystems; inspect auditd or kernel logs for attach/detach events on rc devices performed by non-privileged users.

What your security team should do

• Prioritize patching Nvidia graphics driver packages on all Ubuntu 18.04 and 20.04 systems within standard maintenance windows
• Audit local user permissions on /dev/rc* and related device nodes
• Monitor for future kernel updates that enforce the CAP_NET_ADMIN plus write permission model