CVE-2019-5667: Code Execution in NVIDIA GPU Driver

The core of the vulnerability lies in the DxgkDdiSetRootPageTable handler within nvlddmkm.sys. An attacker can craft malicious input that causes the driver to attempt to dereference a NULL pointer. This can lead to several severe consequences. Code execution allows the attacker to run arbitrary code within the kernel, potentially gaining complete control of the system. Denial of service can be achieved by crashing the driver, rendering the GPU unusable. Privilege escalation allows an unprivileged user to gain elevated privileges, bypassing security restrictions. The potential blast radius is significant, as a compromised GPU driver can impact the entire operating system.

1. Reserved2019-01-07
2. Published2019-02-27
3. Modified2024-09-16
4. EPSS updated2026-04-02

The primary mitigation for CVE-2019-5667 is to update to a patched version of the NVIDIA Windows GPU Display Driver. NVIDIA has not released specific fixed versions as of the publication date, so monitoring NVIDIA's security advisories is crucial. As a temporary workaround, consider implementing strict input validation on any data passed to the DxgkDdiSetRootPageTable function. While not a complete solution, this can reduce the attack surface. WAFs and proxies are unlikely to be effective against this kernel-level vulnerability. After upgrading the driver, confirm the fix by running a memory integrity check and verifying system stability under load.