openSUSE Leap 15.5 — nvidia-open-driver-G06-signed — multiple vulnerabilities (7 CVEs) — patch and remediation guide

📖 ~4 min read  •  Source: SUSE advisory SUSE-SU-2024:1990-1 (see also SUSE bugzilla)

Related CVEs: CVE-2024-0090 CVE-2024-0091 CVE-2024-0092 CVE-2024-0074 CVE-2024-0075 CVE-2022-42265 CVE-2023-31022

Upstream summary: NVIDIA GPU driver for Windows and Linux contains a vulnerability where a user can cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

A flaw in nvidia-open-driver-G06-signed sits underneath every process on the host: local privilege escalation to root, container escape from an unprivileged namespace, memory corruption reachable from a crafted packet, or — in microcode, firmware and bootloader components — a weakness below openSUSE Leap 15.5 entirely. The update only stages files on disk: kernel and initramfs in /boot, blobs under /lib/firmware. The vulnerable code stays resident until the host boots it, which is why a package-database scan calls a host patched while it still runs the flaw. nvidia-open-driver-G06-signed is boot-time code — kernel, modules, device firmware, microcode or bootloader — not a service, so there is no unit to restart; only a reboot (or a livepatch, where one applies) loads the new build.

Environment & Reproduction

Reproduction targets openSUSE Leap 15.5. Confirm release and installed package:

cat /etc/os-release
rpm -q nvidia-open-driver-G06-signed
zypper info nvidia-open-driver-G06-signed | head -20
zypper lr -E                              # enabled repositories
SUSEConnect --status-text 2>/dev/null || echo 'SCC not connected (optional on openSUSE Leap)'

Exercise the workload that uses nvidia-open-driver-G06-signed while collecting:

sudo zypper needs-rebooting; echo "exit=$?"  # SLE15 SP1 / Leap 15.1+ / Tumbleweed: exit 102 (ZYPPER_EXIT_INF_REBOOT_NEEDED) = reboot required, exit 0 = not required
ls -l /run/reboot-needed /var/run/reboot-needed 2>/dev/null  # marker file left by an earlier zypper transaction (path varies by release); 'zypper needs-rebooting' is the authoritative check
sudo journalctl -xe --no-pager | tail -200
sudo tail -200 /var/log/zypp/history
sudo journalctl -k | grep -i apparmor | tail -100
# Bundle evidence for SUSE / community support:
sudo supportconfig -R /var/tmp -B nvidia-open-driver-G06-signed

Root Cause Analysis

Root cause is documented in SUSE advisory SUSE-SU-2024:1990-1. openSUSE security maintainers shipped fixes in the corresponding nvidia-open-driver-G06-signed update for openSUSE Leap 15.5; running an outdated build leaves the host exposed to the failure modes described in the advisory. Correlate zypper history with system logs:

sudo zypper history | grep nvidia-open-driver-G06-signed
sudo zypper history --since='-7 days' | tail -40
sudo journalctl -k | grep -i apparmor | tail -100
cat /proc/sys/kernel/tainted   # non-zero = tainted kernel / out-of-tree modules

Quick Triage

Run these on openSUSE Leap 15.5 to capture the current state of nvidia-open-driver-G06-signed:

rpm -q nvidia-open-driver-G06-signed                              # installed NVR
rpm -V nvidia-open-driver-G06-signed                              # verify shipped files
sudo zypper patch-check                    # open patches
sudo zypper lp 2>/dev/null | head
systemctl --failed --no-pager
sudo firewall-cmd --list-all
sudo aa-status                             # AppArmor profiles
rpm -ql nvidia-open-driver-G06-signed | grep -E '^/(usr/lib|etc)/systemd/(system|user)/[^/]+\.(service|socket|timer|path|target|mount)$'  # the units nvidia-open-driver-G06-signed REALLY ships - NO OUTPUT means it ships no service at all, so never run systemctl on it
rpm -ql nvidia-open-driver-G06-signed | grep -E '^/usr/sbin/rc[^/]+$'  # SUSE-only rcNAME compat symlink (it points at /usr/sbin/service, not at a unit): the NAME after 'rc' IS the service name - bind ships /usr/sbin/rcnamed, so the unit is named.service

Step-by-Step Diagnosis

1. List failed systemd units.

   systemctl --failed --no-pager

2. Tail the journal for nvidia-open-driver-G06-signed and the system bus.

   sudo journalctl -xe -f --no-pager

3. Inspect firewall posture (firewalld is the default on openSUSE).

   sudo firewall-cmd --list-all-zones --permanent
   sudo nft list ruleset 2>/dev/null | head -50

4. Surface AppArmor denials and switch the profile to complain mode if needed.

   sudo journalctl -k | grep -i 'apparmor="DENIED"' | tail -30
   sudo aa-status

5. Verify nvidia-open-driver-G06-signed integrity and reinstall if anything is altered.

   sudo rpm -V nvidia-open-driver-G06-signed
   sudo zypper verify
   sudo zypper install --force nvidia-open-driver-G06-signed

6. Inspect Snapper snapshots to know exactly which transaction introduced the regression.

   sudo snapper list | tail -20
   sudo snapper status <pre-id>..<post-id>

7. Correlate findings with /var/log/zypp/history, zypper history, and SUSE advisory SUSE-SU-2024:1990-1 to pin the change that introduced the regression.

Solution – Primary Fix

Apply the corrective zypper transaction referenced by SUSE advisory SUSE-SU-2024:1990-1, then reload affected systemd units:

sudo zypper ref                        # refresh repos
sudo zypper -n patch                   # apply ALL open patches (recommended)
# Or target a single package:
sudo zypper -n update nvidia-open-driver-G06-signed
# Unit name may differ from pkg name; check first:
rpm -q nvidia-open-driver-G06-signed                           # confirm new NVR

For kernel / glibc / systemd / openssl advisories a reboot is required. Snapper takes pre/post snapshots on Btrfs root automatically, giving a safety net:

sudo zypper ps -s                      # services using deleted libs
sudo snapper list | tail -5            # pre/post snapshots around the patch
sudo systemctl reboot                  # or: sudo shutdown -r now

Solution – Alternative Approaches

If the primary fix is not viable, choose from these:

• Roll back via Snapper (Btrfs snapshots are taken automatically before zypper transactions on openSUSE Leap 15.5). This is the primary safety net for openSUSE administrators:

  sudo snapper list
  sudo snapper status <pre-id>..<post-id>   # diff between two snapshot numbers
  sudo snapper undochange <pre-id>..<post-id>
  sudo snapper rollback <pre-id>            # boot the host into the chosen snapshot
  sudo systemctl reboot

• Lock the package so zypper cannot upgrade it:

  sudo zypper al nvidia-open-driver-G06-signed                   # add lock
  zypper ll | grep nvidia-open-driver-G06-signed                 # list locks
  sudo zypper rl nvidia-open-driver-G06-signed                   # remove lock

• Install an older NVR if a regression is suspected:

  zypper se -s nvidia-open-driver-G06-signed                     # show all available versions
  sudo zypper install --oldpackage nvidia-open-driver-G06-signed-<older-NVR>

• Disable the AppArmor profile briefly to confirm policy is the cause, then re-enable:

  # reproduce, capture denials in the journal:
  sudo journalctl -k | grep apparmor | tail

• openSUSE Leap follows the SUSE Linux Enterprise patch stream. Sync against the official update repository if a mirror has drifted:

  sudo zypper mr -e repo-update          # ensure update repo is enabled
  sudo zypper ref repo-update
  sudo zypper -n patch

Verification & Acceptance Criteria

All of these should pass after the fix:

rpm -q nvidia-open-driver-G06-signed                                            # expected fixed NVR
sudo zypper patch-check                                  # 0 critical patches outstanding
sudo firewall-cmd --list-services
sudo aa-status | head -5
sudo zypper ps -s                                        # any services still using deleted libs

The conditions described in the advisory must no longer be reported for nvidia-open-driver-G06-signed across two consecutive runs.

Rollback Plan

Capture state before any change. On openSUSE, Snapper is the canonical rollback path:

rpm -qa > /root/rpm-pre.txt
sudo zypper history list > /root/zypper-history-pre.txt
# Snapper takes pre/post snapshots automatically on Btrfs root.
sudo snapper create -d 'pre-patch-nvidia-open-driver-G06-signed'   # explicit named snapshot
sudo snapper list | head

To revert if the patch / roll is bad:

# Preferred on Btrfs root — boot the prior snapshot:
sudo snapper list
sudo snapper rollback <pre-id>
sudo systemctl reboot
# Or downgrade just the package:
sudo zypper install --oldpackage nvidia-open-driver-G06-signed-<older-NVR>
# Custom AppArmor profile cleanup:

Prevention & Hardening

Reduce the chance of this recurring on openSUSE Leap 15.5:

• Enable automatic patch installation:

  sudo zypper install -y zypper-automatic
  sudo systemctl enable --now zypper-automatic.timer
  # Or use YaST: yast2 online_update_configuration

• Subscribe to opensuse-security-announce and watch suse.com/support/update.

• Lock sensitive packages so they cannot be auto-upgraded:

  sudo zypper al nvidia-open-driver-G06-signed

• Ensure Snapper is enabled on the root subvolume and pre/post hooks run for every zypper transaction. This is the cornerstone of safe openSUSE patching:

  sudo snapper -c root get-config | head
  # Default zypper plugin: /usr/lib/zypp/plugins/commit/snapper.zypp-commit-plugin
  sudo snapper list | tail -10

• Monitor file integrity with AIDE:

  sudo zypper install -y aide
  sudo aide --init && sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
  sudo aide --check

• Keep AppArmor profiles in enforce; review /etc/apparmor.d/ after every package upgrade.

• Apply CIS / openSUSE hardening guidance and use salt or ansible to enforce baseline state across the fleet.

Related Errors & Cross-Refs

Issues that commonly surface alongside a nvidia-open-driver-G06-signed update: zypper lock contention, systemd unit ordering cycles, AppArmor denials, firewalld zone drift, and kernel taint flags. Useful triage:

sudo zypper ps -s
systemd-analyze critical-chain
sudo journalctl -k | grep apparmor | tail
sudo firewall-cmd --get-active-zones
cat /proc/sys/kernel/tainted
sudo snapper list | tail

View all opensuse-leap-15-5 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: SUSE advisory SUSE-SU-2024:1990-1 (see also SUSE bugzilla). Manual pages useful on openSUSE Leap 15.5:

man zypper
man zypper.conf
man systemctl
man journalctl
man firewall-cmd
man snapper
man apparmor
man aa-status

Other resources: openSUSE documentation, suse.com/security, openSUSE security portal, and per-package notes in /usr/share/doc/packages/nvidia-open-driver-G06-signed/ for components implicated in this advisory.

View all openSUSE Leap 15.5 tutorials on the Tutorials Hub →