cnvd - cnvd-2016-10917

cnvd-2016-10917

Vulnerability from cnvd

Title: 多款NVIDIA产品拒绝服务漏洞

Description:

NVIDIA Quadro、NVS和GeForce都是美国英伟达（NVIDIA）公司的显卡产品。GFE GameStream和NVTray都是其中用于优化显卡的组件。

NVIDIA Quadro、NVS和GeForce产品的GFE GameStream和NVTray插件存在拒绝服务漏洞。攻击者可利用该漏洞在系统上执行代码，发起拒绝服务攻击。

Severity: 高

Patch Name: 多款NVIDIA产品拒绝服务漏洞的补丁

Patch Description:

NVIDIA Quadro、NVS和GeForce都是美国英伟达（NVIDIA）公司的显卡产品。GFE GameStream和NVTray都是其中用于优化显卡的组件。

NVIDIA Quadro、NVS和GeForce产品的GFE GameStream和NVTray插件存在拒绝服务漏洞。攻击者可利用该漏洞在系统上执行代码，发起拒绝服务攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://nvidia.custhelp.com/app/answers/detail/a_id/4213

Reference: https://support.lenovo.com/us/zh/product_security/ps500070

Impacted products

Name
['NVIDIA Quadro', 'NVIDIA NVS', 'NVIDIA GeForce']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "93251"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-3161"
    }
  },
  "description": "NVIDIA Quadro\u3001NVS\u548cGeForce\u90fd\u662f\u7f8e\u56fd\u82f1\u4f1f\u8fbe\uff08NVIDIA\uff09\u516c\u53f8\u7684\u663e\u5361\u4ea7\u54c1\u3002GFE GameStream\u548cNVTray\u90fd\u662f\u5176\u4e2d\u7528\u4e8e\u4f18\u5316\u663e\u5361\u7684\u7ec4\u4ef6\u3002\r\n\r\nNVIDIA Quadro\u3001NVS\u548cGeForce\u4ea7\u54c1\u7684GFE GameStream\u548cNVTray\u63d2\u4ef6\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4ee3\u7801\uff0c\u53d1\u8d77\u62d2\u7edd\u670d\u52a1\u653b\u51fb\u3002",
  "discovererName": "Alin Ghica, Joseph Bialek of Microsoft Vulnerability Research and Daniel Cornel.",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://nvidia.custhelp.com/app/answers/detail/a_id/4213",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-10917",
  "openTime": "2016-11-10",
  "patchDescription": "NVIDIA Quadro\u3001NVS\u548cGeForce\u90fd\u662f\u7f8e\u56fd\u82f1\u4f1f\u8fbe\uff08NVIDIA\uff09\u516c\u53f8\u7684\u663e\u5361\u4ea7\u54c1\u3002GFE GameStream\u548cNVTray\u90fd\u662f\u5176\u4e2d\u7528\u4e8e\u4f18\u5316\u663e\u5361\u7684\u7ec4\u4ef6\u3002\r\n\r\nNVIDIA Quadro\u3001NVS\u548cGeForce\u4ea7\u54c1\u7684GFE GameStream\u548cNVTray\u63d2\u4ef6\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4ee3\u7801\uff0c\u53d1\u8d77\u62d2\u7edd\u670d\u52a1\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eNVIDIA\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "NVIDIA Quadro",
      "NVIDIA NVS",
      "NVIDIA GeForce"
    ]
  },
  "referenceLink": "https://support.lenovo.com/us/zh/product_security/ps500070",
  "serverity": "\u9ad8",
  "submitTime": "2016-11-09",
  "title": "\u591a\u6b3eNVIDIA\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2016-3161 (GCVE-0-2016-3161)

Vulnerability from cvelistv5

Published

2016-11-08 20:37

Modified

2024-08-05 23:47

Severity ?

CWE

Escalation of Privileges

Summary

For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the unquoted service path vulnerability in Windows. A successful exploit of a vulnerable service installation can enable malicious code to execute on the system at the system/user privilege level. The CVE-2016-3161 ID is for the GameStream unquoted service path.

References

▼	URL	Tags
	http://nvidia.custhelp.com/app/answers/detail/a_id/4213	x_refsource_CONFIRM
	https://support.lenovo.com/us/en/product_security/ps500070	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/93251	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	Quadro, NVS, GeForce (all versions)	Version: Quadro, NVS, GeForce (all versions)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:47:57.469Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/ps500070"
          },
          {
            "name": "93251",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93251"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Quadro, NVS, GeForce (all versions)",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Quadro, NVS, GeForce (all versions)"
            }
          ]
        }
      ],
      "datePublic": "2016-11-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the unquoted service path vulnerability in Windows. A successful exploit of a vulnerable service installation can enable malicious code to execute on the system at the system/user privilege level. The CVE-2016-3161 ID is for the GameStream unquoted service path."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privileges",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-13T17:57:01",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/product_security/ps500070"
        },
        {
          "name": "93251",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93251"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@nvidia.com",
          "ID": "CVE-2016-3161",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Quadro, NVS, GeForce (all versions)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Quadro, NVS, GeForce (all versions)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the unquoted service path vulnerability in Windows. A successful exploit of a vulnerable service installation can enable malicious code to execute on the system at the system/user privilege level. The CVE-2016-3161 ID is for the GameStream unquoted service path."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Escalation of Privileges"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213",
              "refsource": "CONFIRM",
              "url": "http://nvidia.custhelp.com/app/answers/detail/a_id/4213"
            },
            {
              "name": "https://support.lenovo.com/us/en/product_security/ps500070",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/product_security/ps500070"
            },
            {
              "name": "93251",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93251"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2016-3161",
    "datePublished": "2016-11-08T20:37:00",
    "dateReserved": "2016-03-15T00:00:00",
    "dateUpdated": "2024-08-05T23:47:57.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted