CVE-2021-23175: Nvidia GeForce Experience Privilege Escalation

CVE-2021-23175 Overview

NVIDIA GeForce Experience contains a user authorization vulnerability in its GameStream feature that fails to correctly apply individual user access controls for users on the same device. This authorization bypass vulnerability (CWE-863) allows a low-privileged user to potentially escalate privileges, access sensitive information, tamper with data, and cause denial of service conditions affecting resources beyond the intended security authority of GameStream.

Critical Impact

Local users can bypass access controls to affect other users on the same system, potentially leading to privilege escalation, data theft, and system compromise.

Affected Products

• NVIDIA GeForce Experience (all versions prior to patch)
• Microsoft Windows (as the underlying operating system)
• Systems with GameStream feature enabled

Discovery Timeline

• 2021-12-23 - CVE-2021-23175 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-23175

Vulnerability Analysis

This vulnerability stems from improper authorization controls within the NVIDIA GeForce Experience GameStream component. GameStream is designed to allow users to stream games from their PC to other devices. However, the authorization mechanism fails to properly isolate user sessions and permissions when multiple users share the same device.

The flaw allows a low-privileged local user to access resources and perform actions that should be restricted to other users on the system. The vulnerability requires local access and some user interaction to exploit, but upon successful exploitation, the impact crosses security boundaries affecting the confidentiality, integrity, and availability of other users' resources.

Root Cause

The root cause is classified as CWE-863 (Incorrect Authorization). The GameStream service does not properly validate and enforce user-specific access controls when multiple user accounts exist on the same Windows system. This authorization logic flaw allows one user's session to interact with or affect another user's protected resources.

Attack Vector

The attack requires local access to the system where NVIDIA GeForce Experience is installed. An attacker with a low-privileged user account can exploit the improper access controls in GameStream to:

1. Access resources belonging to other users on the same device
2. Escalate privileges beyond their authorized scope
3. Modify or tamper with data belonging to other users
4. Cause denial of service conditions affecting other users' GameStream sessions

The exploitation requires some user interaction (such as the victim user having an active session), but the impact scope extends beyond the vulnerable component itself, affecting other system resources.

Detection Methods for CVE-2021-23175

Indicators of Compromise

• Unusual process activity from NVIDIA GeForce Experience components accessing cross-user resources
• Unexpected access attempts to other users' GameStream configuration files or data
• Anomalous inter-user communication through GameStream services
• Privilege escalation events originating from GeForce Experience processes

Detection Strategies

• Monitor for cross-user resource access attempts by NVIDIA GeForce Experience processes
• Implement Windows Security Event monitoring for authorization failures and privilege changes involving NVIDIA services
• Deploy endpoint detection rules to identify unusual GameStream service behavior
• Review audit logs for evidence of one user's GameStream session interacting with another user's resources

Monitoring Recommendations

• Enable detailed Windows Security auditing for object access and privilege use events
• Monitor NVIDIA GeForce Experience service logs for unauthorized access patterns
• Implement application whitelisting policies to track unusual behavior from GeForce Experience components
• Configure alerts for privilege escalation attempts originating from gaming software processes

How to Mitigate CVE-2021-23175

Immediate Actions Required

• Update NVIDIA GeForce Experience to the latest patched version immediately
• Disable GameStream feature if not required until the patch is applied
• Limit the number of user accounts on systems where GameStream is used
• Review and restrict local user permissions on affected systems

Patch Information

NVIDIA has released a security update to address this vulnerability. Administrators should consult the NVIDIA Security Bulletin for specific patch information and download instructions. Ensure all instances of GeForce Experience are updated to versions that contain the fix for CVE-2021-23175.

Workarounds

• Disable the GameStream feature in NVIDIA GeForce Experience settings if streaming functionality is not required
• Implement strict user account separation and avoid shared systems where possible
• Use Windows built-in access controls to restrict NVIDIA GeForce Experience service permissions
• Consider uninstalling GeForce Experience entirely on multi-user systems until patches are applied

# Disable GameStream via GeForce Experience settings
# Navigate to: GeForce Experience > Settings > SHIELD > GameStream
# Set GameStream toggle to OFF

# Alternatively, stop and disable the NVIDIA services if not needed
sc stop "NvContainerLocalSystem"
sc config "NvContainerLocalSystem" start= disabled