CVE-2019-5674

NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled. When an attacker has access to the system and creates a hard link, the software does not check for hard link attacks. This behavior may lead to code execution, denial of service, or escalation of privileges.

CVSS v3 7.0 HIGH
CVSS v2.0 6.9 MEDIUM

7.0^/10

CVSS v3 : HIGH

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://support.lenovo.com/us/en/solutions/LEN-27096
http://www.securityfocus.com/bid/107621	Third Party Advisory VDB Entry
https://nvidia.custhelp.com/app/answers/detail/a_id/4784	Patch Vendor Advisory
http://support.lenovo.com/us/en/solutions/LEN-27096
http://www.securityfocus.com/bid/107621	Third Party Advisory VDB Entry
https://nvidia.custhelp.com/app/answers/detail/a_id/4784	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nvidia:geforce_experience:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:45

Type	Values Removed	Values Added
References	~~() http://support.lenovo.com/us/en/solutions/LEN-27096 -~~	() http://support.lenovo.com/us/en/solutions/LEN-27096 -
References	~~() http://www.securityfocus.com/bid/107621 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/107621 - Third Party Advisory, VDB Entry
References	~~() https://nvidia.custhelp.com/app/answers/detail/a_id/4784 - Patch, Vendor Advisory~~	() https://nvidia.custhelp.com/app/answers/detail/a_id/4784 - Patch, Vendor Advisory

Information

Published : 2019-03-28 15:29

Updated : 2024-11-21 04:45

NVD link : CVE-2019-5674

Mitre link : CVE-2019-5674

CVE.ORG link : CVE-2019-5674

JSON object : View

Products Affected

nvidia

geforce_experience

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2019-5674", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "published": "2019-03-28T15:29:00.467", "references": [{"url": "http://support.lenovo.com/us/en/solutions/LEN-27096", "source": "psirt@nvidia.com"}, {"url": "http://www.securityfocus.com/bid/107621", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@nvidia.com"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/4784", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@nvidia.com"}, {"url": "http://support.lenovo.com/us/en/solutions/LEN-27096", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/107621", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/4784", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA GeForce Experience before 3.18 contains a vulnerability when ShadowPlay or GameStream is enabled. When an attacker has access to the system and creates a hard link, the software does not check for hard link attacks. This behavior may lead to code execution, denial of service, or escalation of privileges."}, {"lang": "es", "value": "NVIDIA GeForce Experience, en versiones anteriores a la 3.18, contiene una vulnerabilidad cuando ShadowPlay o GameStream est\u00e1 habilitado. Cuando un atacante tiene acceso al sistema y crea un enlace f\u00edsico, el software no comprueba si se han sufrido ataques de enlace f\u00edsico. Este comportamiento puede conducir a una ejecuci\u00f3n de c\u00f3digo, denegaci\u00f3n de servicio (DoS) o escalado de privilegios."}], "lastModified": "2024-11-21T04:45:19.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:geforce_experience:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FCB6F21-7822-4CEE-96F5-F8712D2E1F2A", "versionEndExcluding": "3.18"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}