Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.
While this security vulnerability has been known since 2004, Rapid7 had issued a report yesterday on the buffer overflow problem in NVIDIA's binary Linux display drivers -- the issue also likely lies in the FreeBSD and Solaris drivers. This issue allows attackers to run code as root either locally or remotely. A working proof of concept is also available from Rapid7. The solution presented in this report is to remove the closed-source NVIDIA module and use the 2D NV module. NVIDIA has, however, stated that this problem has been fixed with the 1.0-9XXX series drivers. Disabling RenderAccel will also resolve this problem on the vulnerable drivers. There is also news on this NVIDIA Linux driver issue at KernelTrap. A thread has been setup on the Phoronix Forums to discuss this problem.