Out-of-bounds Read in Citrix Hypervisor
CVE-2022-34677
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be truncated, which may lead to denial of service or data tampering.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (18.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 18.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Citrix Hypervisor
- Linux Kernel
- NVIDIA Cloud Gaming
- NVIDIA Geforce
- NVIDIA GPU Display Driver
- NVIDIA Nvs
- NVIDIA Quadro
- NVIDIA Rtx
- NVIDIA Tesla
- NVIDIA Vgpu Software (Guest Driver) - Linux, (Virtual GPU Manager), Cloud Gaming Driver), Manager) — versions All versions prior to and including 14.2, 13.4, and 11.9, and all versions prior to the November 2022 release
Weakness classification (CWE)
References
- nvidia.custhelp.com/app/answers/detail/a_id/5415 (Vendor Advisory)
- lists.debian.org/debian-lts-announce/2023/05/msg00010.html (mailing-list, Mailing List)
- security.gentoo.org/glsa/202310-02 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-34677?
- CVE-2022-34677 is a medium-severity vulnerability in Citrix Hypervisor, classified under Out-of-bounds Read. CVSS score: 5.5/10. Published 2022-12-30.
- How severe is CVE-2022-34677?
- Medium severity. CVSS v3 base score is 5.5 out of 10.