CVE-2024-0092: 
Bottlerocket vulnerability analysis and mitigation

NVIDIA GPU Driver for Windows and Linux contains a vulnerability (CVE-2024-0092) where an improper check or improper handling of exception conditions might lead to denial of service. The vulnerability affects multiple NVIDIA GPU driver versions across Windows and Linux platforms, including versions from R470 up to R555 series (NVIDIA Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-703 (Improper Check or Handling of Exceptional Conditions). The issue affects multiple driver branches including R555, R550, R535, and R470 series across both Windows and Linux platforms (NVD).

The primary impact of this vulnerability is denial of service to the affected systems. The vulnerability requires local access and low privileges to exploit, but does not impact confidentiality or integrity of the system (NVIDIA Advisory).

The vulnerability requires local access (AV:L) with low complexity (AC:L) and low privileges (PR:L) to exploit. No user interaction (UI:N) is required for exploitation. The scope is unchanged (S:U), indicating the impact is limited to the vulnerable component (NVD).

NVIDIA has released security updates to address this vulnerability. For Windows systems, updates are available through the NVIDIA Driver Downloads page: R555 version 555.99, R550 version 552.55, R535 version 538.67, and R470 version 475.06. For Linux systems, the fixed versions are: R555 version 555.52.04, R550 version 550.90.07, R535 version 535.183.01, and R470 version 470.256.02 (NVIDIA Advisory).