CVE-2015-7865

Nvidia Stereoscopic 3D Driver Service 7.17.13.5382 - Arbitrary Run Key Creation

Severity Score

7.7

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows does not properly restrict access to the stereosvrpipe named pipe, which allows local users to gain privileges via a commandline in a number 2 command, which is stored in the HKEY_LOCAL_MACHINE explorer Run registry key, a different vulnerability than CVE-2011-4784.

nvSCPAPISvr.exe en el Stereoscopic 3D Driver Service en el controlador de gráficos NVIDIA GPU R340 en versiones anteriores a 341.92, R352 en versiones anteriores a 354.35 y R358 en versiones anteriores a 358.87 en Windows no restringe adecuadamente el acceso a la tubería llamada stereosvrpipe, lo que permite a usuarios locales obtener privilegios a través de una línea de comandos en un comando número 2, que se almacena enla clave de registro HKEY_LOCAL_MACHINE explorer Run, una vulnerabilidad diferente a CVE-2011-4784.

*Credits: N/A

CVSS Scores

NISTv2 7.7

Attack Vector

Adjacent

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-10-19 CVE Reserved
2015-11-24 CVE Published
2023-09-16 EPSS Updated
2024-08-06 CVE Updated
2024-08-06 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-284: Improper Access Control

CAPEC

References (6)

URL	Tag	Source
http://packetstormsecurity.com/files/134520/NVIDIA-Stereoscopic-3D-Driver-Service-Arbitrary-Run-Key-Creation.html	Third Party Advisory
http://www.securitytracker.com/id/1034173	Third Party Advisory

URL	Date	SRC
https://www.exploit-db.com/exploits/38792	2024-08-06
https://code.google.com/p/google-security-research/issues/detail?id=515	2024-08-06

URL	Date	SRC

URL	Date	SRC
http://nvidia.custhelp.com/app/answers/detail/a_id/3807/kw/security	2019-02-13
https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04971867	2019-02-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Nvidia Search vendor "Nvidia"	Gpu Driver Search vendor "Nvidia" for product "Gpu Driver"	>= 340 < 341.92 Search vendor "Nvidia" for product "Gpu Driver" and version " >= 340 < 341.92"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe
Nvidia Search vendor "Nvidia"	Gpu Driver Search vendor "Nvidia" for product "Gpu Driver"	>= 352 < 354.35 Search vendor "Nvidia" for product "Gpu Driver" and version " >= 352 < 354.35"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe
Nvidia Search vendor "Nvidia"	Gpu Driver Search vendor "Nvidia" for product "Gpu Driver"	>= 358 < 358.87 Search vendor "Nvidia" for product "Gpu Driver" and version " >= 358 < 358.87"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe