CVE-2024-0077: 
Linux Ubuntu vulnerability analysis and mitigation

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin (CVE-2024-0077) that allows a guest OS to allocate resources for which it is not authorized. This vulnerability was disclosed in February 2024 and affects multiple NVIDIA vGPU software components (NVIDIA Security).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It is classified under CWE-285 (Improper Authorization) and affects the vGPU plugin component of the NVIDIA Virtual GPU Manager (NVIDIA Security, NVD).

A successful exploitation of this vulnerability can lead to multiple severe consequences including code execution, denial of service, escalation of privileges, information disclosure, and data tampering (NVIDIA Security).

The vulnerability requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L), with no user interaction required (UI:N). The scope is unchanged (S:U) with high impacts to confidentiality, integrity, and availability (NVIDIA Security).

NVIDIA has released security updates to address this vulnerability. For vGPU Manager, users should update to version 535.161.05 (for version 16.4) or 470.239.01 (for version 13.10) depending on their branch. The updates are available through the NVIDIA Licensing Portal (NVIDIA Security).