NVIDIA GPU Display Driver - Windows kernel mode layer (nvlddmkm.sys): An attacker with local access reads sensitive

Impact

An attacker with local access reads sensitive system-level information through the Windows display driver - useful for fingerprinting the host before a heavier attack. Only matters to you if you run Windows GPU nodes - VDI/DaaS session hosts, cloud-gaming fleets, Windows render or CAE farms.

Who can reach it

Local and unprivileged on a Windows GPU node, through the driver's private IOCTL / DxgkDdiEscape path. Any interactive or RDP/Citrix session with a GPU handle can call it, so on a multi-session VDI host every logged-in user is in range.

What to do

Install the fixed Windows display driver from bulletin 5670. Cost: a Windows display-driver replacement reboots the node, so drain sessions first. Linux-only fleets can skip this entirely.

References