NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial

Versions reported by the vendor

Affected version ranges reported by the assigning authority (nvidia). Independent of NVD's CPE analysis and usually ahead of it.

• NVIDIA NVIDIA GPU Display Driver, vGPU software

  • R535, R550, R560, R565affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2024-0150NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buf
  28Monitor
• CVE-2024-53869NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory.
  22Monitor
• CVE-2024-0131NVIDIA GPU kernel driver for Windows and Linux contains a vulnerability where a potential user-mode attacker could read  a buffer with an in
  17Monitor
• CVE-2024-0149NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files.
  13Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.