CVE-2023-0185: nvidia vgpu software (virtual gpu manager - citrix hypervisor, vmware vsphere, red hat enterprise linux kvm), nvidia cloud gaming (virtual gpu manager - red hat enterprise linux kvm) Unsigned to Signed Conversion Error
Vulnerability summary
CVE-2023-0185 is a high (CVSS 7.1) Unsigned to Signed Conversion Error vulnerability in nvidia vgpu software (virtual gpu manager - citrix hypervisor, vmware vsphere, red hat enterprise linux kvm), nvidia cloud gaming (virtual gpu manager - red hat enterprise linux kvm). EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.4% of scored vulnerabilities.
Timeline
- 01-04-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where sign conversion issuescasting an unsigned primitive to signed may lead to denial of service or information disclosure.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA6.7MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
0.00 pp
From 0.22% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-196Unsigned to Signed Conversion ErrorThe product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
- CWE-681Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Affected systems
Ubuntu22 products
- nvidia-graphics-drivers-304All versions (No fix recorded)
- nvidia-graphics-drivers-340All versions (No fix recorded)
- nvidia-graphics-drivers-384All versions (No fix recorded)
- nvidia-graphics-drivers-390All versions (No fix recorded)
- nvidia-graphics-drivers-418-serverAll versions (No fix recorded)
Debian4 products
- nvidia-graphics-drivers< 525.105.17-1
- nvidia-graphics-drivers-tesla< 525.105.17-1
- nvidia-graphics-drivers-tesla-470< 470.182.03-1
- nvidia-open-gpu-kernel-modules< 525.105.17-1
Nvidia2 products
- vgpu software (virtual gpu manager - citrix hypervisor, vmware vsphere, red hat enterprise linux kvm), nvidia cloud gaming (virtual gpu manager - red hat enterprise linux kvm)All versions prior to and including 15.1, 13.6, 11.11, and all versions prior to and including February 2023 release
- virtual_gpu< 11.12 | ≥ 13.0, < 13.7 | ≥ 15.0, < 15.2
3 vendors · 28 products
References
5 links- security.gentoo.org/glsa/202310-02Third Party Advisory
