NVIDIA has released a security advisory detailing what products are affected by the Log4Shell vulnerability that is currently exploited in a wide range of attacks worldwide.
After a thorough investigation, NVIDIA has concluded that the Log4j vulnerabilities do not impact the following products:
- GeForce Experience client software
- GeForceNOW client software
- GPU Display Drivers for Windows
- L4T Jetson Products
- SHIELD TV
Log4Shell impact
While NVIDIA consumer applications are unaffected, some NVIDIA enterprise applications include Apache Log4j and need to be updated:
- Nsight Eclipse Edition versions below 11.0 are vulnerable to CVE-2021-33228 and CVE-2021-45046 and are fixed in version 11.0 or later.
- NetQ is vulnerable to CVE-2021-33228, CVE-2021-45046, and CVE-2021-45105 on versions 2.x, 3.x, and 4.0.x. As such, users are advised to upgrade to NetQ 4.1.0 or later.
- vGPU Software License Server is impacted by CVE-2021-33228 and CVE-2021-45046 on versions 2021.07 and 2020.05 Update 1. The recommended practice in these cases is to follow this mitigation guide.
NVIDIA also warns that CUDA Toolkit Visual Profiler includes Log4j files but that the application is not using them. An updated version is being released in January 2022 to remove these files.
“Log4j is included in CUDA Toolkit. However, it is not being used, and there is no risk to users who have the Log4j files,” explains NVIDIA’s security notice.
“Because they are not being used, an update is being prepared to remove the Log4j files from CUDA Toolkit. If concerned, customers can safely delete the files as a mitigation.”
Finally, by default, DGX Systems does not come with the Log4j library, but NVIDIA warns that some users may have installed it themselves. In those cases, users are advised to update to the latest available version of the library or remove it altogether.
NVIDIA’s investigation is still ongoing and concerns any products or services that weren’t listed as affected or not impacted on the above lists.
In contrast, the other major player in the GPU market, AMD, has confirmed that none of their products are affected by the Log4shell exploit.
Unfortunately, many other products are affected, so all organizations must perform a complete audit of their vulnerable software, especially those exposed to the Internet.
However, even vulnerable internal applications need to be updated, as threat actors use the Log4Shell vulnerability to spread laterally within networks to deploy ransomware.
GeForce Experience update
While unrelated to Log4j, NVIDIA has released a security update for the NVIDIA GeForce Experience software, addressing CVE-2021-23175 (CVSS v3 score: 8.2).
This vulnerability is a user authorization problem that can lead to privilege escalation, information disclosure, data tampering, and denial of service.
All versions prior to 3.24.0.126 are affected by this high-severity flaw. Launching the software triggers an automatic update.
GeForce Experience is a companion application that helps users update their GPU drivers, optimize game settings, etc. However, users can always source driver updates directly from the NVIDIA website and install them manually.
This means that if you don’t use the application for gaming performance enhancements, you can safely remove it from your system and have one less security worry for now.
Source: www.bleepingcomputer.com