Chaotic Eclipse Released A PoC For NVIDIA GreenSection Memory Corruption Zero-Day
NVIDIA's shared memory system in Windows has a flaw that can crash apps using its graphics tech. An attacker could exploit this to break games or tools, and possibly escalate privileges later.
- Report priority
- High
- Targets
- Windows
How it works
- NVIDIA's Windows graphics drivers share a global memory space that all users can read and write.
- When apps using Vulkan or OpenGL run, they reuse data from this shared space.
- An attacker could trick an app into writing outside its own memory space, causing it to crash.
- The flaw does not immediately give full system control, but it could let an attacker move between user accounts or target Windows's desktop manager process.
What to do
If you use NVIDIA graphics drivers on Windows and run apps that use Vulkan or OpenGL, check your NVIDIA driver version by opening the NVIDIA Control Panel or running nvidia-smi in Command Prompt. If you see a version older than the latest stable release, check for updates in the NVIDIA Control Panel or visit NVIDIA's support site for the latest driver version. The exact vulnerable versions are not yet named in public details.
Until a fix is available, avoid running untrusted apps that use Vulkan or OpenGL. If you suspect an app is malicious, do not open it.
Technical details
NVIDIA's GreenSection vulnerability (tracked as NEWS-937207d5a224675319) is a memory corruption flaw in Windows user-mode components. Multiple NVIDIA drivers share a global memory section (\BaseNamedObjects\{52813408-3561-4705-820a-2b3b78be92ba}) with unrestricted read/write access, which stores critical data structures. While runtime checks prevent misuse, the same data is reused improperly at runtime, enabling an out-of-bounds memory write.
Though it doesn't immediately grant SYSTEM privileges, an attacker could escalate to cross-user boundary attacks or corrupt the Windows Desktop Window Manager (dwm.exe) process. A proof-of-concept demonstrates the crash of Vulkan/OpenGL applications upon exploitation. Researchers noted the bug could serve as a stepping stone for further exploitation.