NVIDIA Windows GPU Display Driver, 3D Vision stereo service: A privileged NVIDIA service opens files without checking

Impact

A privileged NVIDIA service opens files without checking for hard links, so an unprivileged user can point it at a file they should not be able to write and get arbitrary overwrite - the standard route to SYSTEM on Windows.

Who can reach it

Any local unprivileged user on a Windows host with the driver's stereo service running.

What to do

Install the fixed Windows GPU Display Driver branch listed in the NVIDIA bulletin. nvlddmkm.sys is a kernel driver: the swap needs a host reboot, so on a Windows GPU node this is a drain-and-reboot, not a live driver reload. No VBIOS or BMC flash involved.

References