CVE-2022-28192

Name	CVE-2022-28192
Description	NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where it may lead to a use-after-free, which in turn may cause denial of service. This attack is complex to carry out because the attacker needs to have control over freeing some host side resources out of sequence, which requires elevated privileges.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1011140, 1011143, 1011144, 1011145, 1011146, 1011147

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nvidia-graphics-drivers (PTS)	jessie/non-free	340.106-1	vulnerable
	stretch/non-free (security), stretch/non-free (lts), stretch/non-free	390.144-1~deb9u1	vulnerable
	buster/non-free	418.226.00-3	vulnerable
	bullseye/non-free	470.256.02-2	fixed
	bookworm/non-free-firmware	535.183.01-1~deb12u1	fixed
	trixie/non-free-firmware, sid/non-free-firmware	535.216.03-1	fixed
nvidia-graphics-drivers-tesla-418 (PTS)	bullseye/non-free	418.226.00-6~deb11u2	vulnerable
	sid/non-free	418.226.00-16	vulnerable
nvidia-graphics-drivers-tesla-450 (PTS)	bullseye/non-free	450.248.02-7~deb11u1	fixed
	sid/non-free	450.248.02-8	fixed
nvidia-graphics-drivers-tesla-460 (PTS)	bullseye/non-free	460.106.00-17~deb11u1	vulnerable
	sid/non-free	460.106.00-18	vulnerable
nvidia-graphics-drivers-tesla-470 (PTS)	bullseye/non-free	470.256.02-1~deb11u2	fixed
	bookworm/non-free	470.256.02-1~deb12u1	fixed
	trixie/non-free, sid/non-free	470.256.02-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
nvidia-graphics-drivers	source	jessie	(unfixed)	end-of-life
nvidia-graphics-drivers	source	stretch	(unfixed)	end-of-life
nvidia-graphics-drivers	source	bullseye	470.129.06-5~deb11u1
nvidia-graphics-drivers	source	(unstable)	470.129.06-1		1011140
nvidia-graphics-drivers-tesla-418	source	(unstable)	(unfixed)		1011143
nvidia-graphics-drivers-tesla-450	source	bullseye	450.191.01-1~deb11u1
nvidia-graphics-drivers-tesla-450	source	(unstable)	450.191.01-1		1011144
nvidia-graphics-drivers-tesla-460	source	(unstable)	(unfixed)		1011145
nvidia-graphics-drivers-tesla-470	source	(unstable)	470.129.06-1		1011146
nvidia-graphics-drivers-tesla-510	source	experimental	510.73.08-1
nvidia-graphics-drivers-tesla-510	source	(unstable)	510.73.08-2		1011147

Notes

[buster] - nvidia-graphics-drivers <ignored> (Non-free not supported)
[bullseye] - nvidia-graphics-drivers-tesla-418 <ignored> (Non-free not supported, driver is EOLed and updates impossible)
[bullseye] - nvidia-graphics-drivers-tesla-460 <no-dsa> (Non-free not supported)
[bullseye] - nvidia-graphics-drivers-tesla-470 <no-dsa> (Non-free not supported)
https://nvidia.custhelp.com/app/answers/detail/a_id/5353