Connect with us

Hi, what are you looking for?

Technology

NVIDIA discloses applications impacted by Log4j vulnerability


nvidia

NVIDIA has released a security advisory detailing what products are affected by the Log4Shell vulnerability that is currently exploited in a wide range of attacks worldwide.

After a thorough investigation, NVIDIA has concluded that the Log4j vulnerabilities do not impact the following products:

  • GeForce Experience client software
  • GeForceNOW client software
  • GPU Display Drivers for Windows
  • L4T Jetson Products
  • SHIELD TV

Log4Shell impact

While NVIDIA consumer applications are unaffected, some NVIDIA enterprise applications include Apache Log4j and need to be updated:

  • Nsight Eclipse Edition versions below 11.0 are vulnerable to CVE-2021-33228 and CVE-2021-45046 and are fixed in version 11.0 or later.
  • NetQ is vulnerable to CVE-2021-33228, CVE-2021-45046, and CVE-2021-45105 on versions 2.x, 3.x, and 4.0.x. As such, users are advised to upgrade to NetQ 4.1.0 or later.
  • vGPU Software License Server is impacted by CVE-2021-33228 and CVE-2021-45046 on versions 2021.07 and 2020.05 Update 1. The recommended practice in these cases is to follow this mitigation guide.

NVIDIA also warns that CUDA Toolkit Visual Profiler includes Log4j files but that the application is not using them. An updated version is being released in January 2022 to remove these files.

“Log4j is included in CUDA Toolkit. However, it is not being used, and there is no risk to users who have the Log4j files,” explains NVIDIA’s security notice.

“Because they are not being used, an update is being prepared to remove the Log4j files from CUDA Toolkit. If concerned, customers can safely delete the files as a mitigation.”

Finally, by default, DGX Systems does not come with the Log4j library, but NVIDIA warns that some users may have installed it themselves. In those cases, users are advised to update to the latest available version of the library or remove it altogether.

NVIDIA’s investigation is still ongoing and concerns any products or services that weren’t listed as affected or not impacted on the above lists.

In contrast, the other major player in the GPU market, AMD, has confirmed that none of their products are affected by the Log4shell exploit.

Advertisement. Scroll to continue reading.

Unfortunately, many other products are affected, so all organizations must perform a complete audit of their vulnerable software, especially those exposed to the Internet.

However, even vulnerable internal applications need to be updated, as threat actors use the Log4Shell vulnerability to spread laterally within networks to deploy ransomware.

GeForce Experience update

While unrelated to Log4j, NVIDIA has released a security update for the NVIDIA GeForce Experience software, addressing CVE-2021-23175 (CVSS v3 score: 8.2).

This vulnerability is a user authorization problem that can lead to privilege escalation, information disclosure, data tampering, and denial of service.

All versions prior to 3.24.0.126 are affected by this high-severity flaw. Launching the software triggers an automatic update.

GeForce Experience is a companion application that helps users update their GPU drivers, optimize game settings, etc. However, users can always source driver updates directly from the NVIDIA website and install them manually.

This means that if you don’t use the application for gaming performance enhancements, you can safely remove it from your system and have one less security worry for now.



Source link

Advertisement. Scroll to continue reading.
Click to comment

Leave a Reply

Advertisement

Latest

Technology

NVIDIA has released a security advisory detailing what products are affected by the Log4Shell vulnerability that is currently exploited in a wide range of...

Top Stories

Sameep is the founder of QuickSwap, a decentralized exchange on Polygon that allows users to swap, earn, stack yields, lend, borrow and leverage, all...

Online Business Success

A woman walks past gold jewellery displayed in a shop window at the Gold Souq in Dubai, United Arab Emirates March 24, 2018. —...

Top Stories

While still leading the securities litigation, hedge fund and SEC defense national practices at my last law firm, BakerHostetler, my practice team members and...

Top Stories

The Advertising Standards Authority (ASA), a body that oversees advertising in the United Kingdom, is cracking down on non-compliant crypto advertisements. Earlier this year,...

Technology

Source: Daniel Bader / Android Central Apple has made huge changes to its best MacBooks over the past year or so, first introducing the...

Top Stories

Bitcoin (BTC) may have fluctuated in price this year, but BTC remains a better play than the biggest crypto stocks. New data currently circulating...

Top Stories

In an announcement made on Wednesday, China’s official Xinhua News Agency will issue its first series of NFT collectibles. The move is a thumbs...

Advertisement

You May Also Like

SEO Guide

How to index website on Google? Do you want to drive more organic traffic to your new website? I am sure your answer is...

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Blogging

In this post, I will discuss the top ten profitable blogging niches ideas for Adsense approval and high traffic. whether you use Blogger or...

SEO Guide

Want to rank in Google image search? Images that you use as a featured images when writing a post actually appear on Google Images...

Advertisement