CVE-2024-0150
Published: 28 January 2025
Summary
CVE-2024-0150 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Custhelp (inferred from references). Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-0150 affects the NVIDIA GPU display driver for Windows and Linux. The vulnerability involves data being written past the end or before the beginning of a buffer, corresponding to CWE-787 (Out-of-bounds Write). It carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) and was published on 2025-01-28.
A local attacker with low privileges can exploit this issue with low attack complexity and no user interaction. Successful exploitation might result in information disclosure, denial of service, or data tampering, particularly impacting integrity and availability with high severity but no confidentiality impact.
The NVIDIA security advisory provides details on mitigation and patches at https://nvidia.custhelp.com/app/answers/detail/a_id/5614.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-15949
Vulnerability details
NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful exploit of this vulnerability might lead to information disclosure, denial of service, or…
more
data tampering.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in GPU driver directly enables local privilege escalation from low-privileged context (T1068); secondary DoS/tampering effects are possible but less specific to ATT&CK techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires timely application of NVIDIA-provided patches to directly eliminate the out-of-bounds write vulnerability in the GPU display driver.
Memory protection safeguards such as non-executable memory and address space randomization prevent successful exploitation of the buffer overflow for code execution, data tampering, or denial of service.
Information input validation enforces bounds checking on data passed to the GPU driver, mitigating out-of-bounds writes triggered by local low-privilege attackers.