CVE-2021-1056: 
NVIDIA Graphics Driver vulnerability analysis and mitigation

The vulnerability CVE-2021-1056 was discovered in the NVIDIA GPU Display Driver for Linux, affecting all versions of the kernel mode layer (nvidia.ko). The vulnerability was disclosed on January 7, 2021, and was discovered by Xinyuan Lyu of Intelligent Mobile Systems Group, MOE KLINNS Lab, Xi'an Jiaotong University (NVIDIA Bulletin).

The vulnerability exists in the kernel mode layer (nvidia.ko) where it fails to completely honor operating system file system permissions to provide GPU device-level isolation. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (NVIDIA Bulletin).

The exploitation of this vulnerability could lead to denial of service or information disclosure in affected systems. The vulnerability affects the GPU device-level isolation, potentially allowing unauthorized access to GPU resources (NVIDIA Bulletin, Ubuntu Security).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No user interaction is needed for exploitation. The scope is unchanged, affecting only the local system (NVIDIA Bulletin).

NVIDIA has released security updates to address this vulnerability. For Linux systems, the fixed versions are: R460 branch - version 460.32.03, R450 branch - version 450.102.04, R390 branch - version 390.141, and R418 branch - version 418.181.07. Users are advised to upgrade to these versions or later (NVIDIA Bulletin).