CVE-2022-21813: Nvidia Cloud Gaming Guest DOS Vulnerability

CVE-2022-21813 Overview

CVE-2022-21813 affects the NVIDIA GPU Display Driver for Linux. The kernel driver improperly handles insufficient permissions or privileges. An unprivileged local user can obtain limited write access to protected memory, leading to denial of service. The flaw maps to [CWE-284] Improper Access Control and [CWE-755] Improper Handling of Exceptional Conditions. NVIDIA assigned this issue a medium severity rating and addressed it across consumer, professional, datacenter, and virtual GPU product lines.

Critical Impact
A local low-privileged attacker can write to protected kernel memory regions managed by the NVIDIA driver, triggering denial of service against the host GPU subsystem and impacting workload availability.

Affected Products

NVIDIA GPU Display Driver for Linux (GeForce, NVS, Quadro, RTX, Tesla)
NVIDIA Virtual GPU (vGPU) software
NVIDIA Cloud Gaming Guest driver components

Discovery Timeline

2022-02-07 - CVE-2022-21813 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21813

Vulnerability Analysis

The vulnerability resides in the NVIDIA Linux kernel-mode GPU driver. The driver fails to enforce sufficient permission checks when handling certain operations originating from user space. As a result, a local user without elevated privileges can issue requests that the driver processes against protected memory regions. The condition produces limited write primitives constrained in scope but sufficient to corrupt driver-managed state and disrupt GPU operations.

Impact is centered on availability. Confidentiality is not affected, integrity impact is limited, and successful exploitation can crash or hang the GPU stack. In multi-tenant environments using virtual GPU partitioning, this disruption can cascade to co-located workloads sharing the same physical accelerator.

Root Cause

The root cause is improper handling of insufficient permissions inside the kernel driver, classified under [CWE-284] and [CWE-755]. Code paths that should reject requests from unprivileged callers instead proceed to operate on protected memory. The driver does not return an appropriate error or sanitize the request when privilege validation fails, allowing the write to occur in a constrained fashion.

Attack Vector

Exploitation requires local access and low-privileged credentials on the affected host. No user interaction is required. The attacker invokes the vulnerable driver interface, such as an ioctl to the NVIDIA character device, with crafted parameters that bypass the intended privilege check. No public proof-of-concept code is available, and the issue is not listed in CISA KEV. See the NVIDIA Support Article for vendor-confirmed technical details.

Detection Methods for CVE-2022-21813

Indicators of Compromise

Unexpected kernel log entries from the nvidia module referencing failed memory operations, Xid errors, or driver resets in dmesg and /var/log/kern.log.
GPU process crashes, hung CUDA contexts, or sudden loss of display output on systems with affected driver versions installed.
Repeated ioctl calls to /dev/nvidia* device nodes from non-root processes preceding driver instability.

Detection Strategies

Inventory installed NVIDIA driver versions across Linux hosts and compare against the fixed versions listed in NVIDIA security bulletin 5312.
Monitor for unprivileged user processes opening /dev/nvidiactl or /dev/nvidia[0-9] and issuing high volumes of ioctl requests.
Correlate GPU subsystem crashes with the executing user context to identify potential local abuse patterns.

Monitoring Recommendations

Forward kernel ring buffer logs and NVIDIA driver telemetry to a centralized SIEM for retention and correlation.
Alert on GPU driver resets, Xid fault codes, and abnormal nvidia-smi reporting on production GPU nodes.
Track patch compliance on workstations, AI/ML training clusters, and virtual GPU hypervisors hosting tenant workloads.

How to Mitigate CVE-2022-21813

Immediate Actions Required

Apply the NVIDIA GPU Display Driver update for Linux published in NVIDIA Security Bulletin 5312.
On Gentoo systems, upgrade the nvidia-drivers package per Gentoo GLSA 202310-02.
Restrict interactive and SSH access on GPU-equipped hosts to trusted administrators only.

Patch Information

NVIDIA released fixed Linux driver branches addressing CVE-2022-21813 as documented in the vendor advisory. Operators should install the updated driver package from NVIDIA or their Linux distribution and reload the kernel module or reboot the host. Virtual GPU deployments must update both the host vGPU manager and the guest drivers to the patched versions.

Workarounds

Limit local logon rights and remove shell access for non-administrative accounts on GPU servers.
Apply Linux capability restrictions and namespace isolation to constrain processes able to interact with /dev/nvidia* device nodes.
Where immediate patching is not possible, schedule maintenance windows to deploy the fix and monitor dmesg for driver faults until remediation completes.

bash

# Configuration example: verify installed NVIDIA driver version and restrict device access
nvidia-smi --query-gpu=driver_version --format=csv
cat /proc/driver/nvidia/version

# Restrict access to NVIDIA device nodes to a trusted group
sudo groupadd -r nvidia-users
sudo chgrp nvidia-users /dev/nvidia*
sudo chmod 0660 /dev/nvidia*