Slashdot Mirror
Nvidia Display Driver Service Attack Escalates Privileges On Windows Machines
L3sPau1 writes "A zero-day exploit has been found in the Nvidia Display Driver Service on Windows machines. An attacker with local access can use the exploit to gain root privileges on a Windows machine. Windows domains with relaxed firewall rules or file sharing enabled can also pull off the exploit, which was posted to Pastebin by researcher Peter Winter-Smith."
Use Omega drivers, I stopped using Nvidia drivers about the time they started putting an Nvidia windows user on my systems for "gathering performance data".
A zero-day exploit has been found in the Nvidia Display Driver Service on Windows machines. An attacker with local access can use the exploit to gain root privileges on a Windows machine. Windows domains with relaxed firewall rules or file sharing enabled can also pull off the exploit, which was posted to Pastebin by researcher Peter Winter-Smith.
Granted, I've seen worse, but c'mon, man, you're getting paid for this shit.
Pay attention.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Bad link?
Missing "to".
Oh, timothy...
isn't the term root reserved for linux machines, isn't it called admin for windows?
are you aware of any OS that does not suffer by privilege escalation exploits ? if so, be a dear and share it with the rest of us.
Let's see how fast this one is either fixed or spinned into "it's a feature, really, don't worry about it".
Closed source - it's like open source, but to only those that can read assembly.
let the bitcoin farming begin! lol.
MS-DOS.
You kind of need "privileges" in order to have privilege escalation.
I'm wondering if such a pipe system is used (or such a service is enabled) on the NVIDIA binary driver blob for the Linux kernel. Could that be another possible attack vector, or is that not possible with this?
It basically abuses the fact that the.
NVIDIA for unix/Linux had another vulnerability earlier this year pointed out in the article at also at Nvidia's own customer web site http://nvidia.custhelp.com/app/answers/detail/a_id/3140 custhelp.com site for nvidia which showed that using VGA access to RAM allows indiscriminate access to RAM and possible escalation of user privileges with this memory access. Here's the comment from Dave Airlie at the email archive on seclists.org:
Notice how with binary blobs how end-users are screwed and dependent upon the provider of the blob to fix things. Nvidia didn't do anything until after public disclosure of the bug, even though they were notified of the exploit more than three months earlier.
I know reading 101 is a fail for most /. users, but for fucks sake even the summary points out it is an NVidia exploit. Or do you somehow think Linux would be magically immune to a kernel level exploit in NVidia drivers?
yay! i'm upgrading to ms-dos right now!
Store confidential data on a cloud server that does not use nvidia - now it's okay if your PC is hacked. If your computer gets used as a bot, sue nvidia and profit.
severs are starting to use GPS for CPU tasks
If it were going to put people at risk I'd not have released exploit code and I'd have informed the vendor and kept quiet until a fix were issued.
Just when you were scoring high marks, you had to keep flapping your jaws. Vendors (especially NVidia) do not traditionally respond to polite suggestions regarding their buggy code -- you would have eventually been forced to go public, and the vulnerability would have gone that much longer unaddressed. People with insecure systems that would otherwise be none-the-wiser can now take steps to protect themselves until a patch can be developed. There is no reason to sit on this, even if it were easier to exploit, being that it's a non-essential, third-party service that is easily disabled by even a novice user... going public was and would be the most prudent course of action.
Linux Nvidia drivers don't open an SMB named pipe (which, for added bonus can be used for remote attacks from same domain), so this one exploit is pretty much Windows specific. And yeah, you just proved your point.
so because nvidia software opens a pipe, it's windows fault. well done descartes!
I believe there's no need to have the vulnerable nvsvc32.exe service running. It might break the NVIDIA control panel, but the driver should function properly with that service turned off. You could do that until a fixed version is available. The actual driver is named nvlddmkm.sys.
Clearly a windows specific problem.
THIS COULD NEVER HAPPEN ON LINUX.... except that one time when it did.
http://www.zdnet.com/privilege-escalation-security-hole-found-in-nvidia-linux-driver-7000001986/
a linux privesc exploit using the nvidia driver came out months ago.
Interestingly, I found my last surviving copy of DOS just the other day. I was planing on firing up the Tandy 1500 laptop to see if it still worked.
Was running with this service disabled for a long time and didn't notice any ill effects except for missing NV Control panel - switching it to Manual or Automatic makes it work again.
Services.msc management console calls it "NVidia Display Driver Service". Just try stopping it first, if you're doubting an AC's word, and check how everything runs for you, then switch it to Disabled.
CP/M.
They're there in their room. You're on your own.
OMG NOOOOOOOOOO!!!!!!!!
Plan 9 and most Micro Kernels. No root to escalate to \ from. Sometimes there's groups to worry about but non-*nix systems usually avoid stuff like sudoers or even plugdev and will use a lot more groups with far fewer privileges per group.
:)
Every update I redisable all the nvidia services, startup tasks, and shell extensions, breaking nothing of value.
Spot on-Top Marks - mod him up to +5 INFORMATIVE people (if you have mod points that is, I don't)...
* I just tested it with Doom III, Quake IV, GLQuake/Tenebrae, & "alles ist goot"... you can dump running ALL Nvidia services in fact (the updater, the std. service for it, & 3dVision (unless a game requires it &/or you use it that is)).
Yes... it appears the "penguins" are 'reaching' & failing, in their usual "let's *try* shootdown Microsoft &/or Windows" with this one... & as usual, around here.
APK
P.S.=> Besides - afaik, this ISN'T a "remote exploit" (as in someone can't get your IP address & attempt to use it against you)... look @ the conditions required for it for Pete's sake!
I only cursorily read the summary & article + source, & it sounds like it's only good on a local network!
(IF you're not connected to one? Hell, no big deal @ all really, since you're on a 'stand-alone' system. If you keep your system fully currently patched + security-harden it?? Especially no biggie... nothing can take advantage of it (as in other malware that attempt to exploit this in the meantime prior to patching, & SOMETHING tells me, NVidia will have it fixed in a jiffy anyhow - they're not going to sit around for their BIGGEST MARKET ON PERSONAL COMPUTERS & let that be that way))...
... apk
I know reading 101 is a fail for most /. users, but for fucks sake even the summary points out it is an NVidia exploit. Or do you somehow think Linux would be magically immune to a kernel level exploit in NVidia drivers?
Good job failing reading 101 yourself.
The summary points out that nVidia's Windows Service is exploitable rather than the display driver itself. Why would you think that would affect Linux?
Oh, and that's without even mentioning that Windows and Linux drivers aren't written in the same language (C++ for Windows, C for Linux) and don't use the same kernel API.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
The NVidia Control Panel has some 'niceties' for folks that don't manually "tweak & tune" their games via the game itself's native configuration files.
(OH, there's MORE TO IT than just that, that's just an example I've used @ times myself from its contents).
For example (since I am a HUGE longtime fan of IDSoftware & a /. member Mr. John Carmack's work)?
DoomCfg.cfg (Doom III) + Quake4.cfg (Quake4) allow a LOT of "little tricks" for both performance or visual quality. You can seriously "adjust" ID's games there, any way you like.
HOWEVER/Per my subject-line above:
What the control panel does is SAVE that for you (since the NVidia driver can override game configuration data for the driver to process), across MANY games!
All so you don't have to do all the reading & study to do it manually, game by game.
* That's about it though... guess it really depends on the user!
APK
P.S.=> More just a "matter of convenience" for users that aren't "big" on tweaking I'd say (however, gaming was what led ME to tweaking tuning my OS, + games, as far back as DOS 5.0 here, so I could get more outta them/more "bang-for-the-buck")...
... apk
Oh the irony, He didn't say the exploit was in the driver, he said it was an Nvidia exploit and then pointed out a reasonably legitimate comparison for what NVidia has on Linux. If you are going to correct someone at least read what they fucking wrote.
You can do that, & "easy as apple pie" too, as follows:
E.G.-> Open NVidia drivers with WinRar & extract out the Display.Driver folder someplace on your harddrive.
(That folder has the libs/dlls & .sys files necessary (+ other 'perhipheral files' too) & the .inf file, for doing exactly what you want!)
Then, just use devmgmt.msc to "update driver" for the video display device (Diplay Adapter) by clicking on it, & then right-clicking to "update driver" by pointing to the place you extract that folder out to on your harddisk.
* And, "voila" - should work!
APK
P.S.=> Should be as simple as that, per your request... IF you try this? Let me know how it works out - should be fine technically, & it's easy to "get out of too" by simply uninstalling the driver IF necesssary (system will default back to last driver or SVGA std.)...
... apk
And also anal about what kinda bullshit services people force to run in the backgrounds.
I sure as hell hope governments keep sensative information a little better then I do =) Wouldnt want the sekrets to the universe and UFOs and free energy get out.
he removed the exploit has anybody made backups and is willing to share them ? Because I have friends that will get into trouble when this is not fixed asap.
You mean from the Windows family? No, I can't name any. There always some bullshit way to get privilege escalation on any Windows system just as there are always going to be apologists trying to explain that it's normal, that we should lower our expectation and that, supposedly, all OSes are created equals when it comes to security.
Is that your point? That all the OSes are created equal when it comes to security?
I've seen pretty hardened SELinux or grsec boxen for that matter and, despite following closely every single security out there I've had servers that didn't any patching for... Years!
Sure, there may be some exploit once in a while, but it's hardly the fiasco that Windows is.
Run SERVICES.MSC - disable NVidia services there (or just set them MANUAL till you are SURE all your apps work - upon reboot especially)!
No reboot required for it to work here though!
SO, DO TEST like I did with your games or 3d display related apps -> http://it.slashdot.org/comments.pl?sid=3344029&cid=42406941
* That should make it doable for you, easily via GUI no less...
APK
P.S.=> It'll work, it did for me @ least & yes, ON Win7 64-bit!
(Addendum - I've done it before long ago on 32-bit NT-based OS for ages too, before I bought into the 64-bit world so I could do 64-bit apps, & test them here too, ala -> http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
... apk
Stopped reading there. If they've got local access they can do whatever the hell they want regardless, one more attack vector isn't going to make or break things.
Windows 3.1
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
No, however the Linux Nvidia drivers run in kernel mode (video driver in Vista + runs in user space) and can thus do anything the kernel can do.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Dude, don't try to fuck with me by quoting me and and then misquoting me to argue against me by changing closed source "binary blob" into "C code". I was pointing out the foolishness of accepting closed source binary blobs. Your fuck-headed response was to conflate "closed source code" with "C code", perhaps implying "hard to read or understand code"? Too bad you can't wrap your head around code, or figure out how to get an account on /. instead of living your life anonymously and with extreme cowardice. Other people who can read the code and understand it would appreciate open code as opposed to closed code. Blah, blah, nya-nya-nanny-boo-boo, so there! (Laugh a little, you moron; if you want to argue with me, deal with my arguments rather than making a bitchy straw man argument which you can set on fire. Nobody argued your useless point of view!)
;>p
;>)
!!!
Do not use Nvidia GPU.
There are GPUs from other vendors in the market.
Vote with your wallet.
Muchas Gracias, Señor Edward Snowden !
Another exploit for this POS OS.
This one appears to be due to nvidia's binary drivers. Every platform is equally vulnerable to evil kernel level code.
Besides exploits for Windows are so frequent that they are not news. Unless they hit hundreds of thousands of exploits overnight it's just business as usual.
are you aware of any OS that does not suffer by privilege escalation exploits ? if so, be a dear and share it with the rest of us.
What a dumb reply.
There are hundreds of these a year on windows. Windows has so many security problems because it's based on a broken design.
Windows 8 can't even prevent a kernel driver running in privileged space from doing this? Ewww...
none
http://it.slashdot.org/comments.pl?sid=3344029&cid=42407525
A user installs a backdoor with system privileges and it's the OS's fault?
Clearly it shouldn't have let you install nvidia drivers, or something.
"Unfortunately the exploit had to be removed, feel free to follow me on Twitter" .. link
AccountKiller
Windows 3.1
... is not an operating system. Try again.