CVE-2024-0075: 
Bottlerocket vulnerability analysis and mitigation

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user may cause a NULL-pointer dereference by accessing passed parameters the validity of which has not been checked. This vulnerability was assigned CVE-2024-0075 and was disclosed in February 2024. The vulnerability affects NVIDIA GPU Display Drivers for both Windows and Linux operating systems (NVIDIA Security).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) issue. It has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction to exploit (NVIDIA Security, NVD).

A successful exploit of this vulnerability may lead to denial of service and limited information disclosure. The vulnerability affects multiple NVIDIA GPU Display Driver branches including R550, R545, and R535 for both Windows and Linux systems (NVIDIA Security).

The vulnerability requires local access to exploit, with low attack complexity and low privilege requirements. No user interaction is needed for exploitation. The vulnerability can be triggered by accessing passed parameters without proper validity checks (NVIDIA Security).

NVIDIA has released security updates to address this vulnerability. For Windows systems, users should update to version 551.61 for R550 branch. For Linux systems, users should update to version 550.54.14 for R550 branch, version 535.161.07 for R535 branch. The updates are available through the NVIDIA Driver Downloads page (NVIDIA Security).