A high-severity race condition vulnerability in the NVIDIA GPU Display Driver installer for Linux and Solaris systems could allow a local attacker to escalate privileges and compromise system integrity.

This vulnerability is a time-of-check time-of-use (TOCTOU) race condition within the installer package. A local attacker with low privileges can exploit this flaw during the installation process to execute arbitrary code or modify system data.

The ability for a local user to escalate privileges to a higher permission level poses a significant risk to the confidentiality, integrity, and availability of host systems. With a CVSS score of 7.0, this flaw represents a high risk for enterprise environments where multiple users or automated processes share access to Linux or Solaris workstations and servers. Successful exploitation could allow an attacker to bypass security controls, leading to full system compromise.

Immediate Action: Update the NVIDIA GPU Display Driver to the latest version provided in the official vendor advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5670.

Proactive Monitoring: Audit system logs for unexpected execution of the installer package or unauthorized attempts to access restricted installer directories.

Compensating Controls: Restrict local access to systems utilizing the affected driver versions and ensure that only authorized administrators can execute installer packages on Linux or Solaris environments.

Public Exploit Available: No

Given the potential for privilege escalation and code execution, administrators should prioritize updating affected NVIDIA drivers. While the attack vector requires local access, the impact of a full system compromise is severe. Apply the vendor-supplied patches immediately to mitigate the risk of local exploitation.