NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it doesn't release some resources during driver unload requests from guests. This flaw allows a malicious guest to perform operations by reusing those resources, which may lead to information disclosure, data tampering, or denial of service. This affects vGPU version 12.x (prior to 12.3), version 11.x (prior to 11.5) and version 8.x (prior 8.8).
References
| Link | Resource |
|---|---|
| https://nvidia.custhelp.com/app/answers/detail/a_id/5211 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
30 Jul 2021, 13:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:nvidia:virtual_gpu:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 4.6
v3 : 7.8 |
| CWE | CWE-404 | |
| References | (CONFIRM) https://nvidia.custhelp.com/app/answers/detail/a_id/5211 - Vendor Advisory |
21 Jul 2021, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it doesn't release some resources during driver unload requests from guests. This flaw allows a malicious guest to perform operations by reusing those resources, which may lead to information disclosure, data tampering, or denial of service. This affects vGPU version 12.x (prior to 12.3), version 11.x (prior to 11.5) and version 8.x (prior 8.8). |
21 Jul 2021, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-07-21 03:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-1098
Mitre link : CVE-2021-1098
CVE.ORG link : CVE-2021-1098
JSON object : View
Products Affected
nvidia
- virtual_gpu
CWE
CWE-404
Improper Resource Shutdown or Release