Slashdot Mirror

← Back to Stories (view on slashdot.org)

NVIDIA Releases Fix For Dangerous Display Driver Exploit

Posted by Soulskill on from the nothing-like-fixing-bugs-over-the-holidays dept.

wiredmikey writes "NVIDIA on Saturday quietly released a driver update (version 310.90) that fixes a recently-uncovered security vulnerability in the NVIDIA Display Driver service (nvvsvc.exe). The vulnerability was disclosed on Christmas day by Peter Winter-Smith, a researcher from the U.K. According to Rapid7's HD Moore, the vulnerability allows a remote attacker with a valid domain account to gain super-user access to any desktop or laptop running the vulnerable service, and allows an attacker (or rogue user) with a low-privileged account to gain super-access to their own system. In addition to the security fix, driver version 310.90 addresses other bugs and brings performance increases for several games and applications for a number of GPUs including the GeForce 400/500/600 Series."

84 comments

  1. No 7-series support? by qwertphobia · · Score: 1

    Looks like they're now dropping support for the Geforce 7-series cards. Bummer, I have a 7800GT and it's still pretty quick.

    --
    Never ask for directions from a two-headed tourist! -Big Bird
    1. Re:No 7-series support? by Anonymous Coward · · Score: 3, Informative

      Really? Try this page.
      http://www.geforce.com/drivers/results/49740
      Still plenty of support for the 7 series.

    2. Re:No 7-series support? by Osgeld · · Score: 0

      your probably the jerk who drive a 72 buick on the interstate cause it feels fine at 55mph

      I dont like upgrading, but a 7800 was like 3 machines ago ... cause its a nearly 8 year old card

    3. Re:No 7-series support? by qwertphobia · · Score: 1

      Not far off.. it's a '96 f-150 and I drive it like I stole it some days. And I get what you're trying to say... but my 7800 runs just fine and these days 90% of my time on my PC is spent in email and web browsers.

      --
      Never ask for directions from a two-headed tourist! -Big Bird
    4. Re:No 7-series support? by Osgeld · · Score: 1

      then you would be fine on any card, whats the problem, use the windows default drivers

    5. Re:No 7-series support? by Anonymous Coward · · Score: 1

      here you go a nice affordable replacement for your aging card. yeah yeah no need to thank me for the hot find. it's a real steal!

    6. Re: No 7-series support? by Anonymous Coward · · Score: 0

      7800GT? Quick?

      No it isn't.

    7. Re:No 7-series support? by Elbart · · Score: 1

      They've announced to stop support 6- and 7-series a few months back. You should be reading the release notes once in a while.

    8. Re:No 7-series support? by Anonymous Coward · · Score: 0

      Actually, most of those older land-barge cars feel fine at much higher speeds than most of the subcompact cars that are popular today. I know, I drive the modern version of one of those--a Crown Victoria--and, having come from a Toyota Corolla where 120 km/h started to feel worrisome (top speed 160 km/h for my year, after all) I have to actually monitor my speed now to ensure I don't get a ticket. The Crown Vic can get to 160 km/h+ on the highway and I don't even notice it other than whizzing by the other traffic.

      Now, I'm not saying the old-style BOF, RWD, live axle, huge vehicles are safe at those speeds, but the feeling presented to the driver is that they can do it safely.

  2. nvvsvc.exe by Anonymous Coward · · Score: 0

    What does nvvsvc.exe do anyhow?

    1. Re:nvvsvc.exe by Anonymous Coward · · Score: 0

      Nothing!

    2. Re:nvvsvc.exe by Anonymous Coward · · Score: 0

      I have no idea, but I have always disabled it ever since it was introduced with absolutely no adverse effects. I've tried searching for an exact answer as to what it's supposed to do, but every single answer is some clueless moron saying it's "part of the Nvidia driver" and to "leave it alone". I don't care how little RAM or CPU time a service is using, if it's unnecessary, it's gone. In my experience it's completely unnecessary and you can safely disable it.

    3. Re:nvvsvc.exe by X0563511 · · Score: 1

      Probably detecting driver freezes and restarting it.

      It's something I've only seen happen rarely - but I've had a game "lock up" for a few seconds, only to be greeted by a notification that the driver froze and was restarted. The game died, but the whole system did not (without this functionality it would have been a power cycle)

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    4. Re:nvvsvc.exe by jones_supa · · Score: 1

      Isn't that functionality built in Windows instead of nvvsvc.exe?

    5. Re:nvvsvc.exe by X0563511 · · Score: 1

      I don't believe so, but I could be wrong. If it is, it doesn't seem to trigger correctly for ATI/AMD cards when I've had some limited time using them.

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    6. Re:nvvsvc.exe by Anonymous Coward · · Score: 0

      It has been starting with Vista.
      Windows XP however does not have the the ability to dynamically stop, start, and restart display drivers and detect eventual crashes. So there such a service is needed.

    7. Re:nvvsvc.exe by jones_supa · · Score: 1

      It works for Intel cards.

  3. Dangerous ? Nope. by lemur3 · · Score: 4, Interesting

    Not like a CRT catching fire...

    I remember hooking up an old CRT to the wrong video card.. one with way too a high resolution for that screen..

    A while later, hooked up to the correct video card, I noticed a bit of smoke coming out from where the dials were.. removed the case.. plugged it in again to see if it was OK .. it burst into 3 foot high flames.

    thankfully a fire extinguisher was about 3 feet away... mom would have been awfully mad if i had burned down the house.... scared the bejeezes out of me ... the burnt electrical smell was horrendous..

    (bonus: it was a fancy no mess extinguisher)

    lesson learned.

    1. Re:Dangerous ? Nope. by earlzdotnet · · Score: 5, Funny

      The more I learn about the past of computing the more I'm convinced they only ever considered one failure mode: catastrophic.

    2. Re:Dangerous ? Nope. by Anonymous Coward · · Score: 1

      It appears as though you have found a use for is_computer_on_fire().

      http://www.tycomsystems.com/beos/BeBook/The%20Kernel%20Kit/System.html

      Good old BeOS. Man I miss that operating system (though Haiku fills that gap nicely), but moreso the radical hardware that came with it (BeBox).

    3. Re:Dangerous ? Nope. by Anonymous Coward · · Score: 4, Informative

      http://en.wikipedia.org/wiki/Lp0_on_fire

    4. Re:Dangerous ? Nope. by jamesh · · Score: 1

      Not like a CRT catching fire...

      I remember hooking up an old CRT to the wrong video card.. one with way too a high resolution for that screen..

      A while later, hooked up to the correct video card, I noticed a bit of smoke coming out from where the dials were.. removed the case.. plugged it in again to see if it was OK .. it burst into 3 foot high flames.

      thankfully a fire extinguisher was about 3 feet away... mom would have been awfully mad if i had burned down the house.... scared the bejeezes out of me ... the burnt electrical smell was horrendous..

      (bonus: it was a fancy no mess extinguisher)

      lesson learned.

      Bullshit...

      Possibly, but not necessarily. Older hardware wasn't always manufactured to "must not burn" specifications, and scanning at too high resolution could definitely cause damage to the monitor (and there were warnings in the manuals to that effect). My guess would be that the damage would be through overheating so fire is definitely a possibility, especially if the thing is full of flammable crud (fluff, paper dust, etc). 3 foot high flames might be an exaggerated memory of a distant past but I'm willing to believe the essence of the story.

    5. Re:Dangerous ? Nope. by Black+LED · · Score: 1

      I have never seen flames come out of a CRT display, but I have witnessed at least two which have died after emitting a decent amount of black smoke. One was an old 14" Hyundai SVGA monitor and the other was a Compaq of some sort. The Hyundai had been in use for years at that point and had already suffered some kind of circuit board failure that prevented the the blue gun from firing, resulting in a golden image tone.

    6. Re:Dangerous ? Nope. by Gaygirlie · · Score: 2

      Bullshit...

      I doubt that. I've actually seen myself an old CRT bursting into flames shortly after I noticed the plastic on its side turning brownish and starting to melt. The thing is, CRTs are a very much different kind of a beast than our LCDs and a CRT can indeed be permanently damaged just by sending a wrong kind of a signal. Sending a wrong signal enough could cause the capacitors to blow and this could result in a fire. Have you ever opened a CRT-display? Those things have huge voltages going on there. I once opened this 21" high-end CRT and the warning labels on the rails there read 17,000 volts.

    7. Re:Dangerous ? Nope. by X0563511 · · Score: 1

      I raise you a CPU opcode, HCF

      --
      For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
    8. Re:Dangerous ? Nope. by mrmeval · · Score: 1

      NEC had one glorious little monitor, pretty thing and expensive but if were plugged into the wrong card it would most of the time sheer the picture tube off, it would at best damage the phosphor. This would happen right at the part of the yoke closest to the face. Couple an odd reaction by the vertical circuit to a higher vertical frequency to an increase in horizontal frequency resulting in a very high boost in high voltage unchecked by an inadequate x-ray protect and you had in effect an electron cutting beam till air entered and arcing caused it to finally draw enough current to trip the safety. NEC just replaced them with more expensive units.

      --
      I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
    9. Re:Dangerous ? Nope. by ATMD · · Score: 1

      Nice screen saver.

      --
      Nobody else has this sig.
    10. Re:Dangerous ? Nope. by Shark · · Score: 1

      Made in Britain?

      --
      Mind the frickin' laser...
    11. Re:Dangerous ? Nope. by Zero__Kelvin · · Score: 2

      "mom would have been awfully mad if i had burned down the house"

      ... until she realized that it finally got you out of her basement?

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    12. Re:Dangerous ? Nope. by Anonymous Coward · · Score: 0

      So I take it you have never heard of fixed frequency monitors?

      Hmmm, oh well. Your loss. I was enjoying 1600x1200 in 1995 for about $200 on a trinitron monitor (that was one attached to a Textronix workstation) because of that.

  4. No it didn't by ArchieBunker · · Score: 1

    I've *NEVER* heard of a single instance of a refresh rate or too high of a scanning frequency causing monitor failure. Seems like a trivial thing to fix for a monitor manufacturer. Would you sell a product that shot out fire if someone clicked a slider setting too high?

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard
    1. Re:No it didn't by Anonymous Coward · · Score: 0

      Later CRTs simply switch off if you try to drive them too high, older ones didn't.

      I remember a shitty 14" CRT I had to use for a while that couldn't support anything over 800x600@60Hz, but, damn, it tried. No bursting in flames, but that noise and those pictures weren't pretty. Some extra shitty hardware could probably go up in flames like that.

      Or maybe it was just something like poor grounding and shock while plugging/unplugging it live in OP's case.

    2. Re:No it didn't by lemur3 · · Score: 1

      it was one of these..

      GATEWAY 2000 CRYSTALSCAN 1024NI

        http://meghan.schnooze.com/Photos/ToSell/monitor.jpg

      think it was 14 inch..

      and to the naysayers! yes! it really did happen.

    3. Re:No it didn't by Black+LED · · Score: 1

      But dude! Crystalscan! CRYSTALSCAN!

    4. Re:No it didn't by Kjella · · Score: 1

      I think I experienced that. It was in the 80s, old IBM PC and somehow the machine froze - not just the screen but it didn't respond to input or anything, but I left it running in the hope it'd recover. Suddenly there was a rather loud bang as a capacitor blew and released its magic smoke. Of course it could be coincidence, but I suspect it was the computer crashing and sending a very bad signal to the screen. This was the age where you'd check machine and screen compatibility before plugging it in, probably for a good reason.

      --
      Live today, because you never know what tomorrow brings
    5. Re:No it didn't by drinkypoo · · Score: 1

      I've *NEVER* heard of a single instance of a refresh rate or too high of a scanning frequency causing monitor failure.

      It's not the kind of thing that is likely to crop up, is it? The only monitors which will even try to sync to a bad frequency were ancient multisyncs, modern ones are smart enough to detect a signal out of range. And you'd pretty much have to have some bad hardware for it to happen.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    6. Re:No it didn't by ais523 · · Score: 1

      If you overclock a monitor, you can expect similar results to if you try to overclock a CPU. (In general, it's going to overheat.) Because it's rather easier to do by mistake than it is for a CPU, monitors tend to check for it nowadays and cut out intentionally.

      --
      (1)DOCOMEFROM!2~.2'~#1WHILE:1<-"'?.1$.2'~'"':1/.1$.2'~#0"$#65535'"$"'"'&.1$.2'~'#0$#65535'"$#0'~#32767$#1"
    7. Re:No it didn't by Anonymous Coward · · Score: 0

      While I don't doubt that your monitor blew up, I *DO* doubt it blew up because your refresh was too high.

      I'm guessing you powered off the crt when you swapped leads? My memory seems to recall this particular beastie had four diodes for the rectifier, instead of an all-in-one bridge. If just one of those failed shorted when you plugged it back in/turned it on (inrush current), then it would still power up, but with a heavy AC component now feeding into the rest of the circuits (and capacitors). Fireworks will soon ensue.

      Just sayin'

    8. Re:No it didn't by ATMD · · Score: 1

      Would you sell a product that shot out fire if someone clicked a slider setting too high?

      I have one of those, I use it for sticking bits of metal together.

      --
      Nobody else has this sig.
  5. Turn your flipping auto-updater on by GodfatherofSoul · · Score: 2

    The days of trying to manually screen each update your system needs are over. Too many components are vulnerable and the turnaround time for an exploit is too short.

    --
    I swear to God...I swear to God! That is NOT how you treat your human!
    1. Re:Turn your flipping auto-updater on by Anonymous Coward · · Score: 0

      Good luck with that if you have a laptop.

      OEMs are notorious for lagging on updating drivers. The latest video drivers that Dell has for my Quadro-based laptop are 259.70, which was released in January 2011. It's only recently that NVIDIA has taken the matter into their own hands and started rigging their generic drivers to work with laptop parts, and even then they still have to warn on the driver download page about possible issues and required patches for specific laptops. There is also pretty much an entire website dedicated to hacking NVIDIA driver INFs for this purpose.

    2. Re:Turn your flipping auto-updater on by Anonymous Coward · · Score: 0

      Oh yeah, like I'm going to let everything that has it's own auto-updater run whenever the fuck it feels like. I think not. I actually like my machine to boot quickly instead of having umpteen different things all trying to check to see if they need updating at the same goddamn time. I don't let them schedule themselves either because most of the ones for things I use seem to want to stay resident all the damn time even if they aren't due to check for an update for several days. Nevermind that windows can schedule them to run, oh no, they've got to load on startup and stay resident.

      Fuck that noise. Updaters run when I schedule them to run and not at any other time.

    3. Re:Turn your flipping auto-updater on by DrXym · · Score: 2

      Laptop driver support can be *horrible* because manufacturers twiddle with the chipsets params so that means their drivers are machine specific and certified. I'm writing this on an old netbook with Intel IGP. The OpenGL implementation is bugged so I want to install a later driver which is up on Intel's site. Can I install this driver? No because it decides "the driver being installed is not validated for this computer". And HP don't give a fuck about providing a certified version.

    4. Re:Turn your flipping auto-updater on by Black+LED · · Score: 1

      I have been using notebook drivers direct from Nvidia for quite some time; at least since I bought the laptop prior to my current one, which would have been in late 2008. Maybe it was different for the Quadro, but they have had mobile GeForce drivers available for download for years.

      I don't know if this will work for you, but here are the Quadro Notebook Drivers v310.90 dated yesterday.

    5. Re:Turn your flipping auto-updater on by Anonymous Coward · · Score: 0

      You're doing it wrong.

      > like I'm going to let everything that has it's own auto-updater run whenever the fuck it feels like.

      All driver updates are downloaded by the system updater, which can be configured when it should run. Or disabled and run manually, if you really want.

      You also confuse "check for updates" and "actually update". When the system updater detects new updates, it asks you if you want to install them now or later.

      > I actually like my machine to boot quickly instead of having umpteen different things all trying to check to see if they need updating at the same goddamn time.

      The system updater checks at regular intervals, not every boot.

      > I don't let them schedule themselves either because most of the ones for things I use seem to want to stay resident all the damn time even if they aren't due to check for an update for several days.

      They don't stay resident, they are run by the Task Scheduler or Cron Daemon (or equivalent), and the latter is the only thing that stays resident.

      > Nevermind that windows can schedule them to run, oh no, they've got to load on startup and stay resident.

      This sentence contradicts to itself. If Windows can schedule them they don't have to load on startup or stay resident.

    6. Re:Turn your flipping auto-updater on by Anonymous Coward · · Score: 0

      Unfortunately nvidia broke their auto-updater. The updates user is created with an expiring password. When the password eventually expires, it breaks the auto-updater.

    7. Re:Turn your flipping auto-updater on by Anonymous Coward · · Score: 0

      Yeah, this has always bugged the hell out of my. Why the fuck did Nvidia decide the only way they could update a graphics driver, was to create A WHOLE NEW USER on my computer? No over piece of software or driver needs this. Did no-one at nividia stop and think what they were doing wrong, or give the boys at Microsoft or whatever a call to ask about the correct way of doing this?

    8. Re:Turn your flipping auto-updater on by jones_supa · · Score: 1

      Which netbook?

    9. Re:Turn your flipping auto-updater on by DrXym · · Score: 1

      An HP Mini 210. OpenGL ES 2.0 driver is totally broken - I'm on holiday and using it for development and the driver just crashes whenever glLinkProgram is called. Seems to be a widespread issue so I assume it's a driver fault.

    10. Re:Turn your flipping auto-updater on by jittles · · Score: 1

      I have been using notebook drivers direct from Nvidia for quite some time; at least since I bought the laptop prior to my current one, which would have been in late 2008. Maybe it was different for the Quadro, but they have had mobile GeForce drivers available for download for years. I don't know if this will work for you, but here are the Quadro Notebook Drivers v310.90 dated yesterday.

      Whether you can install the latest and greatest drivers from NVidia, or have to download from your OEM depends on the OEM. They usually tweak some settings (PCI Device ID) specifically so that the default NVidia drivers will not install. They do this for support purposes. You can modify the INF for the Nvidia drivers and force them to install, but it can be a pain to get them working right sometimes. For instance, when Vista came out, I bought a new laptop. Dell restricted the drivers so I couldn't use the Windows XP drivers for my video card. I had to find this solution to be able to run XP on the device.

    11. Re:Turn your flipping auto-updater on by Black+LED · · Score: 1

      That used to be true, but it hasn't been like that for a long time. The Nvidia notebook drivers seem to be pretty universal. While I can't say with certainty that they will work with all laptops, I haven't run across that particular problem in years. I've installed the unified notebook drivers across a dozen different models among perhaps a half dozen brands, none of them any older than seven years, and they have worked without any fuss.

      All I can recommend is for you to give them a shot. They will probably work.

    12. Re:Turn your flipping auto-updater on by Anonymous Coward · · Score: 0

      The problem with auto-update is the way that, occasionally, a system that is functioning perfectly fine will get borked by a broken update, or install something incompatible with some other software that is essential. There have been plenty of stories here on slashdot about updates that have been pushed out without enough testing. It has happened even for critical OS updates, let alone individual applications that have gone bad. On top of that, some OS (read: Windows) have upteen different update tools, one for every application/driver set. All that stuff running in the background has to be maintained too, and apart from the resource hogging and constant phoning home, it can have its own security flaws.

      My solution is to strip out everything that is unnecessary (e.g., nvvsrv.exe wasn't even running on my machine -- I had already killed it). That pre-emptively deals with a surprising amount of problems. Adobe Reader, for example, has all sorts of fluff that I don't use most of the time, so it's removed or disabled. When I have checked, most of the security updates that it has received in the last few years were in components I had already disabled. It's like leaving JavaScript, Flash, or Java enabled by default in your browser. Do people still do that, and count on auto-update to save them when the next inevitable flaw shows up? I still update regularly, but there's no way I'm turning it on automatically. The principle that "If it isn't broke, don't fix it" still applies.

  6. It's also pretty old by Sycraft-fu · · Score: 4, Insightful

    About 7.5 years old. It is reasonable that they cease supporting it with new drivers. You can still get drivers for it, they have drivers for OSes up to and including Windows 8, they just aren't keeping support in newer unified drivers.

    Sounds pretty reasonable to me. They gave you over 7 years of driver updates. It is fairly unrealistic to assume that they'll continue with new support forever, particularly given that there is little reason. The 7 series can't do WDDM 1.1 or 1.2, it can't handle DirectX 10, 10.1, 11 or 11.1, it can't do CUDA, DirectCompute or OpenCL. There is just little in the way of things to implement for it.

    If you wish to continue using the card, no problem (though be aware that an Intel 4000 series GPU found in Ivy Bridge processors is likely to be faster, and certainly has far more features) just use the 306 series drivers. It will continue to operate with those no problem.

    If the security issues is what you are worried about, it looks like it only affected the 310 drivers, so no issues there.

    1. Re:It's also pretty old by Billly+Gates · · Score: 4, Insightful

      Nvidia and ATI have great cheap $49 cards if you want aero. That can cream the gaming 7800 series easily. No meed to get a new system.

      If it is on XP you have a lot more security issues than this card though.

      --
      http://saveie6.com/
    2. Re:It's also pretty old by qwertphobia · · Score: 2

      Yes, it's reasonable, that doesn't mean I like it. I won't gracefully give up my right to complain on the Internet.

      Frankly it's linux kernel compatibility I'm most concerned about. If Fedora 18 comes out next week with an updated kernel which breaks compatibility with the current 7-series driver, what are the chances it's going to get fixed?

      In the other hand, things are moving along in the Nouveau open source driver so there are alternatives.

      --
      Never ask for directions from a two-headed tourist! -Big Bird
    3. Re:It's also pretty old by davydagger · · Score: 1

      " it can't do CUDA, DirectCompute or OpenCL"

      nouveau is feature complete for 2D and 3D rendering, in addition, without OpenCL, CUDA, or the bells and whistles of new hardware, it just might work better for this guy's application.

      nouveau renders the world wide web just fine, it also works all the way back to NV04.

      Your also not going to be playing the latest games on your old video card anyway.

    4. Re:It's also pretty old by drinkypoo · · Score: 1

      I got a 1GB 610GT for $12 on Black Friday. It's in my system right now because the new fan for my 240GT (still better than the budget cards, anyway) has only just arrived. It's a gimped 520 IIRC and still better than your 7800. Its specs are almost as good as my 240GT (which was a spectacularly good core when the card was new, in spite of it being based on a core which was already old when it was released) but it has 1/4 the fill rate so 1920x1200 is murder.

      I do miss the days when the nVidia driver went all the way back to geforce, but not very much. My oldest card is a 9600 and I don't even use it, it's just my backup for my backup.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    5. Re:It's also pretty old by Anonymous Coward · · Score: 1

      NVC0 family [400 series]
      All sorts of fun. Feature-wise it isn't too different but the architecture has changed a lot.
      These cards are generally working with the latest kernel and Mesa but may still have power management issues. It is recommended to use the Linux 3.1 kernel or newer (or a backported driver from this kernel).

      Oh yea, it sounds perfect!

    6. Re:It's also pretty old by hairyfeet · · Score: 2

      Ya know, I never understood why folks have a fit when Nvidia and AMD drop support, as you pointed out they are several years old now and simply can't do WDDM 1.2 which is required for all the features of Win 8. MSFT has always had legacy drivers built in so you probably won't need a driver at all for an Nvidia 7 or 8, and on the AMD side 2, 3, and 4, so what is there to complain about?

      Hell my HD4850 has had support dropped for nearly a year but Win 7 and all my games run fine so why should I care? Its not like these cards are gonna magically have more performance squeezed out of them via software, all the bugs are pretty much worked out by now, so what good would new drivers do? Considering the fact you can buy an Nvidia 210 for like $20 that will run rings around the old 7 series if he really wants to run win 8 he'd be better off just getting a new card and if he is on XP-7 it should run just fine with the drivers he has.

      The only place i could see it being a problem is Linux but until Torvalds joins the rest of the world and has a stable ABI so older drivers can work on the latest kernel its either the hacked together FOSS drivers or you're SOL. Neither Nvidia nor AMD will ever be able to fully open their drivers thanks to HDCP, AMD were able to give around 65% but that's it and with Nvidia you run a supported card or give it up. But you can't blame the GPU companies for that, when its no longer supported that's it and if the old drivers won't run tough luck, you can't expect them to pay a team of devs to support cards they aren't even selling anymore.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    7. Re:It's also pretty old by Anonymous Coward · · Score: 0

      Frankly it's linux kernel compatibility I'm most concerned about. If Fedora 18 comes out next week with an updated kernel which breaks compatibility with the current 7-series driver, what are the chances it's going to get fixed?

      The 7 series will be supported on Linux through 2017.

    8. Re:It's also pretty old by Lost+Race · · Score: 1

      If it is on XP you have a lot more security issues than this card though.

      Such as?

      I have a few XP systems that are still getting regular automatic patches and updates from Microsoft. You seem pretty confident that all XP systems are vulnerable, so you must be aware of something specific. Care to share?

  7. ATI had an exploit too by Billly+Gates · · Score: 5, Insightful

    Do we as geeks and IT professionals need to worry about this?

    First it was the OS that got you owned. Then when Linux, Macosx, and NT/XP came it was about IE. IE 5.5 and 6 were instant targets. Then as that died off it was flash, java, and ODF addons.

    Are video drivers next? Which never gets updated? The video drivers. Which has its own cpu, ram, and is never checked by AV? The video card. A reflash would be a nightmate.

    --
    http://saveie6.com/
    1. Re:ATI had an exploit too by Anonymous Coward · · Score: 0

      Gamers update their graphics drivers frequently and windows update has a habit of pushing WHQL driver updates.

    2. Re:ATI had an exploit too by DrXym · · Score: 4, Interesting

      Do we as geeks and IT professionals need to worry about this?

      Absolutely. WebGL allows any random website to tap your hardware through the browser. WebGL is essentially OpenGL ES 2.0 give or take a few APIs and is supported by just about every modern browser except IE. Some enable WebGL by default on suitable hardware, some have it disabled by default. When it is enabled a page has carte blanche to abuse the chipset six ways to sunday. The only protection afforded by browsers is the driver has to implement a GL extension called GL_EXT_robustness which says the driver promises, fingers crossed to be really good about checking and recovering from errors.

      ActiveX had something similar called the "safe for scripting" bit. IE wouldn't load a page unless the control said it was safe and look what happened there. While there are less graphics drivers than activeX controls, it's easy to imagine a driver version claiming it's robust when in fact it isn't. It's easy to imagine a malicious site using that fact to break a lot of machines. I assume browsers could implement a whitelist of "good" drivers and update the list in addition to checking for the extension but it's obviously imperfect and offers additional browser exploits where none existed before.

    3. Re:ATI had an exploit too by Anonymous Coward · · Score: 0

      Which sucks badly. If you have a higher driver version installed, in some cases, Windows (7) update fails, crashes and takes a few boots to recover.

    4. Re:ATI had an exploit too by Anonymous Coward · · Score: 0

      Interestingly enough, thanks to the manufacturers making it harder and harder to find legacy drivers for older cards, I find myself constantly downloading drivers from third-party "driver database" websites. Will we start to see an age where loads of rogue sites start popping up and releasing malware through drivers?

    5. Re:ATI had an exploit too by Anonymous Coward · · Score: 0

      Windows update only crashes if you are a moron.

    6. Re:ATI had an exploit too by Anonymous Coward · · Score: 0

      Ummm... Nvidia easily provides access to drivers back to the Geforce 5 FX series, which is now 10 years old - which I think is pretty damn reasonable. BTW, what makes you think those shady 3rd party driver sites aren't already filled with malware? Enjoy your virus laden crap drivers.

  8. Re:Let's see how long it takes to download. by Anonymous Coward · · Score: 0

    Not all of us can masturbate to a 8.4MB/s internet connection. Many of us are less fortunate and can only get a 10KB/s connection.

  9. Re:Let's see how long it takes to download. by Osgeld · · Score: 1

    what sucks is a 170 meg driver download, thats just fucking stupid

    sadly enough I think they got a little smaller

  10. Don't want all the 'bells & whistles'? by Anonymous Coward · · Score: 0

    Do this (to install ONLY the driver): Open the driver distro with WinRar to install ONLY the driver, doing the following (on Windows)

    ---

    1.) Extract out the "Display.Driver" folder to your harddisk (137mb sized, vs. 173mb full distro file = a 36mb size savings which you can use again & again as noted below...)

    2.) Open up devmgmt.msc (an mmc.exe console snapin (& select "Display Adapters", highlight & right-click on the NVidia unit displayed))

    3.) Select "Update Driver Software" from the popup menu, & point the updater to where you extracted the "Display.Driver" folder from the driver distro file on your harddisk earlier...

    DONE!

    ---

    * There ya go... & you can save that Display.Driver folder for future subsequent driver installs too, & reuse it again (it is MUCH tinier & supplies the basics).

    (Nicest part is, it is easy to "rollback"/get out of, since the system will fallback onto SVGA base driver if anything "goes wrong" here, but it shouldn't since the drivers are WHQL tested, usually - but, this should allow you to install whatever version it is you last had running RIGHT, easily...).

    APK

    P.S.=> Lastly - If the SIZE of the inital driver distro file bugs you?

    THEN, Don't download the "INTERNATIONAL" model of the driver distro!

    (It's much larger due to having to house all the extra data for diff. languages/nations, especially if you do NOT require them....)

    E.G.-> 310.70 International model = 215mb & 310.90 non-internation model = 173mb...

    ... apk

  11. Re:Let's see how long it takes to download. by jittles · · Score: 1

    Part of the reason the driver is so big is because they now package all cards into one driver. Well, at least all of their GeForce cards. You literally have generations worth of drivers in one file. Sure they added the PhysX and the HD AUdio driver, 3D crud, and a few other things. However, I think most of that size comes from different driver files. I don't think all of them get installed.

  12. NVidia forgot to test their drivers again ... by Cammi · · Score: 1

    A NVidia, how about fixing your drivers so that it will stop quit providing a signal on windows 8 machines after an hour or so? Should have tested your drivers before release.

    1. Re:NVidia forgot to test their drivers again ... by Zero__Kelvin · · Score: 1

      " how about fixing your drivers so that it will stop quit providing a signal on windows 8 machines after an hour or so"

      You make that plus sound like a drawback.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    2. Re:NVidia forgot to test their drivers again ... by Cammi · · Score: 1

      If a driver does not work, it is not a plus. For instance ... you would not be on a computer ...

    3. Re:NVidia forgot to test their drivers again ... by Zero__Kelvin · · Score: 1

      "If a driver does not work, it is not a plus. For instance ... you would not be on a computer ..."

      ... and by logical inference, if a driver for Windows 8 does not work, I would not be using a Windows 8 computer. Ergo, it is not a drawback; it is a major plus. Please try to follow along with the rest of the class.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    4. Re:NVidia forgot to test their drivers again ... by Cammi · · Score: 1

      Yeah, that made no sense. Please try to follow along with the rest of the class.

    5. Re:NVidia forgot to test their drivers again ... by Zero__Kelvin · · Score: 1

      I know you are but what am I ...

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  13. True - might even make my trick tinier! by Anonymous Coward · · Score: 0

    http://hardware.slashdot.org/comments.pl?sid=3361043&cid=42494263

    * That helps, albeit ONLY imo, if you're looking for BASIC functionality only (minus stuff like the nvtray control panel which DOES offer some niceties, like saving games 'tweaked' how you like, minus having to tune each game via its OWN config files (takes time + mistakes in & of itself), vs. having the driver "override" for you, via this nicety!

    APK

    P.S.=> I mean, I put out the 64-bit driver sizes in my last post too (omitted mentioning that, & they ARE larger due to pointers being larger alone, than their 32-bit couterparts).

    What you're noting would ALSO help!

    Simply by 'busting up' the monolithic driver size into card model specific versions instead!

    (Assuming, of course, that the architecture isn't so "alike" across say, 400-500-600 series boards, etc., hardware-wise, where it would NOT demand tinier individual drivers in .sys files)...

    ... apk

  14. Drivers and the network by obeythefist · · Score: 1

    Excuse me if this is a dumb question, but why is the display driver exposed to the network at all?

    --
    I am government man, come from the government. The government has sent me. -- G.I.R.
    1. Re:Drivers and the network by hobarrera · · Score: 1

      No network access as far as I can see:

      the vulnerability allows a remote attacker with a valid domain account to gain super-user access

      You need an account on the machine to log into it first.