CVE-2022-42258: 
Bottlerocket vulnerability analysis and mitigation

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service, data tampering, or information disclosure. This vulnerability was assigned CVE-2022-42258 and was disclosed in November 2022 (NVIDIA Bulletin).

The vulnerability has been assigned a CVSS base score of 5.3 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The issue is classified as CWE-190 (Integer Overflow) and affects the kernel mode layer of the NVIDIA GPU Display Driver for Linux (NVIDIA Bulletin).

If exploited, this vulnerability could lead to multiple security impacts including denial of service, data tampering, and information disclosure. The vulnerability requires local access with low privileges to exploit (NVIDIA Bulletin).

NVIDIA has released security updates to address this vulnerability across multiple driver branches. For Linux systems, the fixed versions are: R525 (525.60.11), R515 (515.86.01), R510 (510.108.03), R470 (470.161.03), R450 (450.216.04), and R390 (390.157). Users are advised to update to these versions or later (NVIDIA Bulletin, Debian LTS).