Nouveau display driver (in-tree Linux nouveau, NV117): Remote denial of service against a workstation or node running

Impact

Remote denial of service against a workstation or node running the open-source Nouveau driver: a crafted pixel shader delivered through a web page wedges the GPU driver and takes the machine's graphics stack down. No code execution, but on a shared render or VDI host it is a free reboot for anyone who can get a browser to load their page.

Who can reach it

Anyone who can get a user on the host to open a web page - so effectively internet-reachable. No local account needed.

What to do

This is the in-tree open-source Nouveau driver, not NVIDIA's proprietary stack. Update the distribution kernel (Ubuntu 18.04 shipped the vulnerable NV117 code) or, on GPU nodes, blacklist nouveau entirely and run the proprietary NVIDIA driver, which is what a compute fleet should be doing anyway. Kernel update means a node reboot.

References