NVIDIA Unix security team reports:
Security vulnerability CVE-2012-0946 in the NVIDIA UNIX driver
was disclosed to NVIDIA on March 20th, 2012. The vulnerability
makes it possible for an attacker who has read and write access
to the GPU device nodes to reconfigure GPUs to gain access to
arbitrary system memory. NVIDIA is not aware of any reports of
this vulnerability, outside of the disclosure which was made
privately to NVIDIA.
NVIDIA has identified the root cause of the vulnerability and
has released updated drivers which close it. [NVIDIA encourages]
all users with Geforce 8 or newer, G80 Quadro or newer, and all
Tesla GPUs to update their drivers to 295.40 or later.
Later, it was additionally discovered that similar exploit could
be achieved through remapping of VGA window:
NVIDIA received notification of a security exploit that uses
NVIDIA UNIX device files to map and program registers to redirect
the VGA window. Through the VGA window, the exploit can access
any region of physical system memory. This arbitrary memory
access can be further exploited, for example, to escalate user
privileges.