What is CVE-2020-5987?

CVE-2020-5987 is a high-severity vulnerability in NVIDIA Vgpu Software, classified under Incomplete Cleanup. CVSS score: 7.8/10. Published 2020-10-02.

How severe is CVE-2020-5987?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in NVIDIA Vgpu Software

CVE-2020-5987

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin in which guest-supplied parameters remain writable by the guest after the plugin has validated them, which may lead to the guest being able to pass invalid parameters to plugin handlers, which may lead to denial of service or escalation of privileges. This affects vGPU version 8.x (prior to 8.5), version 10.x (prior to 10.4) and version 11.0.

EPSS: 0.003 (24.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Nvidia Vgpu Software — versions vGPU version 8.x (prior to 8.5), version 10.x (prior to 10.4) and version 11.0.
Nvidia Virtual_gpu_manager — versions 11.0

Weakness classification (CWE)

CWE-459 — Incomplete Cleanup

References

psirt@nvidia.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2020-5987?: CVE-2020-5987 is a high-severity vulnerability in NVIDIA Vgpu Software, classified under Incomplete Cleanup. CVSS score: 7.8/10. Published 2020-10-02.
How severe is CVE-2020-5987?: High severity. CVSS v3 base score is 7.8 out of 10.