CVE-2012-0952: 
Linux Debian vulnerability analysis and mitigation

A heap buffer overflow vulnerability was discovered in the device control ioctl in the Linux driver for Nvidia graphics cards (CVE-2012-0952). The vulnerability allowed an attacker to overflow 49 bytes in the kernel buffer. This security issue was addressed and fixed in Nvidia graphics driver version 295.53 (NVD, Launchpad Bug).

The vulnerability stemmed from insufficient size checking in the NV_ESC_CARD_INFO ioctl handler. When processing this ioctl, the driver would write 50 bytes per device to an allocated kernel buffer that was sized according to the input buffer. By providing a minimum 1-byte buffer, an attacker could trigger a 49-byte overflow, as the rm_api->magic check did not abort the ioctl operation (Launchpad Bug).

The vulnerability could potentially allow an attacker to overflow the kernel heap buffer by 49 bytes, which could lead to privilege escalation or system compromise (NVD).

The vulnerability required local access to the system to exploit the device control ioctl in the Nvidia graphics driver (Launchpad Bug).

The vulnerability was fixed in Nvidia graphics driver version 295.53. Users were advised to upgrade to this version or later to address the security issue. Additionally, all supported Ubuntu releases were later upgraded to the 304.x drivers, which also contained the fix (Launchpad Bug).