CVE-2024-0084

This bug is in the system that manages virtual graphics hardware (used by cloud gaming and virtual GPU setups). If someone can run code inside the “guest” environment, that code might be able to perform high-privilege actions it shouldn’t. That can potentially expose data, alter it, gain higher control than intended, or disrupt service.

This matters if your business runs NVIDIA vGPU software for Linux as part of virtual GPU or cloud gaming deployments where users/workloads can affect a guest operating system. The weakness is reachable from inside an environment (not just by sending a web request), so it’s most relevant where an attacker could run code in a guest or otherwise influence the guest OS.

It’s a risk only if the vulnerable vGPU/Virtual GPU Manager component is present in your environment and is reachable via your guest workloads.

This is an AMBER issue: there is a real risk of privilege escalation from inside the guest environment, but there is no confirmation it’s actively exploited in the CISA KEV list and no public exploit code on record. Because cloud gaming/virtual GPU systems are high-value for availability, you should prioritize patching when you can, especially if any untrusted code can run in your guest environments.