Bugzilla – Bug 1220552
VUL-0: CVE-2024-0074,CVE-2024-0075,CVE-2022-42265: kernel-firmware-nvidia-gspx-G06,nvidia-open-driver-G06-signed: Security issues in nvidia's graphics driver
Last modified: 2024-03-26 09:47:23 UTC
nvidia recently made updates of their graphics drivers due to various security issues. I'm attaching a document. I already updated the driver packages on the nvidia server for openSUSE. I can also update the repositories for SLE on the nvidia server once we release the updated packages kernel-firmware-nvidia-gspx-G06 nvidia-open-driver-G06-signed for sle15-sp5 and sle15-sp4(LTSS).
Created attachment 873079 [details] NVIDIA® Predisclosure Security Bulletin - February 2024_v3.pdf
> [...] I can also update the repositories for SLE on the nvidia server once we release the updated packages > > kernel-firmware-nvidia-gspx-G06 > nvidia-open-driver-G06-signed > > for sle15-sp5 and sle15-sp4(LTSS). @Marcus Could you give them again higher priority? Thanks. In case you're wondering, that R545 Driver Branch, which we were using up to now, isn't mentioned in the document. That's the pre-release branch of R550. I'm pretty sure it's affected as well.
CRD: 2024-02-28
It's released now. https://nvidia.custhelp.com/app/answers/detail/a_id/5520
Packages have been checked in for sle15-sp4/sle15-sp5.
SUSE-SU-2024:0772-1: An update that solves three vulnerabilities and contains one feature can now be installed. Category: security (important) Bug References: 1220552 CVE References: CVE-2022-42265, CVE-2024-0074, CVE-2024-0075 Jira References: PED-7117 Sources used: openSUSE Leap 15.5 (src): nvidia-open-driver-G06-signed-550.54.14-150500.3.36.1 SUSE Linux Enterprise Micro 5.5 (src): nvidia-open-driver-G06-signed-550.54.14-150500.3.36.1 Basesystem Module 15-SP5 (src): nvidia-open-driver-G06-signed-550.54.14-150500.3.36.1 Public Cloud Module 15-SP5 (src): nvidia-open-driver-G06-signed-550.54.14-150500.3.36.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0770-1: An update that solves three vulnerabilities and contains one feature can now be installed. Category: security (important) Bug References: 1220552 CVE References: CVE-2022-42265, CVE-2024-0074, CVE-2024-0075 Jira References: PED-7117 Sources used: SUSE Linux Enterprise Micro for Rancher 5.4 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Linux Enterprise Micro 5.4 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Manager Proxy 4.3 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Manager Retail Branch Server 4.3 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Manager Server 4.3 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 openSUSE Leap 15.4 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Linux Enterprise Micro for Rancher 5.3 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 SUSE Linux Enterprise Micro 5.3 (src): nvidia-open-driver-G06-signed-550.54.14-150400.9.50.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Hooray. I verified that nvidia-open-driver-G06-kmp-<flavor> and kernel-firmware-nvidia-gspx-G06 package updates are available for SP4 and SP5. From my point of view this ticket can be closed. Thanks again for prioritizing this!
This is checked in into SUSE:ALP:Source:Standard:1.0 since a long time. There is no 'ALP:Source:Standard:1.0'.
released