NVIDIA binary graphics driver: Privilege escalation vulnerability — GLSA 200611-03

The NVIDIA binary graphics driver is vulnerable to a local privilege escalation through an X session.

Affected packages

x11-drivers/nvidia-drivers on all architectures
Affected versions < 1.0.8776
Unaffected versions >= 1.0.8776
< 1.0.8762

Background

The NVIDIA binary graphics driver from NVIDIA Corporation provides the kernel module and the GL modules for graphic acceleration on the NVIDIA based graphic cards.

Description

Rapid7 reported a boundary error in the NVIDIA binary graphics driver that leads to a buffer overflow in the accelerated rendering functionality.

Impact

An X client could trigger the buffer overflow with a maliciously crafted series of glyphs. A remote attacker could also entice a user to open a specially crafted web page, document or X client that will trigger the buffer overflow. This could result in the execution of arbitrary code with root privileges or at least in the crash of the X server.

Workaround

Disable the accelerated rendering functionality in the Device section of xorg.conf :

Option "RenderAccel" "false"

Resolution

NVIDIA binary graphics driver users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-1.0.8776"

References

Release date
November 07, 2006

Latest revision
November 10, 2006: 02

Severity
high

Exploitable
remote, local

Bugzilla entries