CVE Vulnerabilities

CVE-2021-1120

Improper Null Termination

Published: Oct 29, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be properly null terminated. The guest OS or attacker has no ability to push content to the plugin through this vulnerability, which may lead to information disclosure, data tampering, unauthorized code execution, and denial of service.

Weakness

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Affected Software

Name Vendor Start Version End Version
Virtual_gpu Nvidia 8.0 (including) 8.9 (excluding)
Virtual_gpu Nvidia 11.0 (including) 11.6 (excluding)
Virtual_gpu Nvidia 12.0 (including) 12.4 (excluding)
Virtual_gpu Nvidia 13.0 (including) 13.1 (excluding)

Potential Mitigations

References