CVE-2021-1099

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) that could allow an attacker to cause stack-based buffer overflow and put a customized ROP gadget on the stack. Such an attack may lead to information disclosure, data tampering, or denial of service. This affects vGPU version 12.x (prior to 12.3), version 11.x (prior to 11.5) and version 8.x (prior 8.8).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jul 21, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-11005.5NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel mode driver (nvidia.ko), in which a pointer to a user-space CVE-2021-11015.5NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may lCVE-2021-11025.5NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can lead to floating point exceptions, whicCVE-2021-11034.4NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may lCVE-2021-11049.8The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register that may lead toCVE-2021-11054.4NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to accCVE-2021-11067.8NVIDIA Linux kernel distributions contain a vulnerability in nvmap, where writes may be allowed to read-only buffers, which may result in esCVE-2021-11077.8NVIDIA Linux kernel distributions contain a vulnerability in nvmap NVMAP_IOC_WRITE* paths, where improper access controls may lead to code eCVE-2021-11087.3NVIDIA Linux kernel distributions contain a vulnerability in FuSa Capture (VI/ISP), where integer underflow due to lack of input validation CVE-2021-11096.3NVIDIA camera firmware contains a multistep, timing-related vulnerability where an unauthorized modification by camera resources may result CVE-2021-11107.1NVIDIA Linux kernel distributions on Jetson Xavier contain a vulnerability in camera firmware where a user can change input data after validCVE-2021-11116.7Bootloader contains a vulnerability in the NV3P server where any user with physical access through USB can trigger an incorrect bounds check
CVE-2021-1099: High severity, CVSS 7.8 | Vulnix