CVE-2024-0149: 
Linux Debian vulnerability analysis and mitigation

NVIDIA GPU Display Driver for Linux contains a vulnerability (CVE-2024-0149) which could allow an attacker unauthorized access to files. The vulnerability was discovered and assigned on December 2, 2023, with patches released in January 2025. This vulnerability affects various NVIDIA GPU display driver versions across different Linux distributions (NVIDIA Security, CVE Mitre).

The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (Low severity) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. It is classified under CWE-125, indicating a potential out-of-bounds read vulnerability. The issue affects multiple driver branches including R535, R550, and R570 (NVIDIA Security).

A successful exploit of this vulnerability might lead to limited information disclosure. The vulnerability allows unauthorized access to files, potentially exposing sensitive system information (NVIDIA Security).

NVIDIA has released security updates to address this vulnerability. For Linux systems, the fixed versions are: R570 version 570.86.16, R550 version 550.144.03, and R535 version 535.230.02. Users are advised to update their GPU drivers to these versions or later through the NVIDIA Driver Downloads page (NVIDIA Security).