AVID-2026-R1173

Description

Vulnerability CVE-2023-0189

Details

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Reason for inclusion in AVID: The CVE describes a vulnerability in the NVIDIA Linux GPU Display Driver kernel mode layer that can lead to code execution, DoS, privilege escalation, information disclosure, and data tampering. This driver is a core software component used to run general-purpose AI workloads (GPU-accelerated ML/DL tasks) and is part of the software stack (dependencies/runtimes/drivers) that AI systems rely on. Therefore, it is a security vulnerability with direct implications for the software supply chain of AI systems. Sufficient signal is provided by the vulnerability description, CVSS scoring, and affected products/references.

References

Affected or Relevant Artifacts

Developer: NVIDIA
Deployer: NVIDIA
Artifact Details:

Type	Name
System	vGPU software (guest driver - Linux), NVIDIA Cloud Gaming (guest driver - Linux)

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score	8.8
Base Severity	🔴 High
Attack Vector	LOCAL
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	CHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-822	CWE-822: Untrusted Pointer Dereference

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-04-01
Version: 0.3.3
AVID Entry