FKIE_CVE-2021-34372

Vulnerability from fkie_nvd - Published: 2021-06-22 22:15 - Updated: 2024-11-21 06:10
Severity ?
8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Trusty (the trusted OS produced by NVIDIA for Jetson devices) driver contains a vulnerability in the NVIDIA OTE protocol message parsing code where an integer overflow in a malloc() size calculation leads to a buffer overflow on the heap, which might result in information disclosure, escalation of privileges, and denial of service.
References
psirt@nvidia.comhttps://nvidia.custhelp.com/app/answers/detail/a_id/5205Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://nvidia.custhelp.com/app/answers/detail/a_id/5205Vendor Advisory
Impacted products
Vendor Product Version
nvidia jetson_linux *
nvidia jetson_agx_xavier_16gb -
nvidia jetson_agx_xavier_32gb -
nvidia jetson_agx_xavier_8gb -
nvidia jetson_nano -
nvidia jetson_nano -
nvidia jetson_nano_2gb -
nvidia jetson_tx1 -
nvidia jetson_tx2 -
nvidia jetson_tx2_4gb -
nvidia jetson_tx2_nx -
nvidia jetson_tx2i -
nvidia jetson_xavier_nx -
nvidia jetson_xavier_nx -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8941F71-0292-414E-AEA5-DD55EA3C2009",
              "versionEndExcluding": "32.5.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_16gb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0E081CB-B6EC-42DC-BA04-BCA13C17D190",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F92D471-8E65-41FC-A5DE-255136F6F989",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_agx_xavier_8gb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E29459F7-997A-4B87-9164-6E3B5158ADC3",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_nano:-:*:-:*:*:*:*:*",
              "matchCriteriaId": "9244F123-8518-4D81-AD26-5695F27F413B",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_nano:-:*:developer_kit:*:*:*:*:*",
              "matchCriteriaId": "80BF53A0-8FDF-4827-9C00-ED082C4A68C7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_nano_2gb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "52E153CA-BE89-4C66-8B72-8901BF592423",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_tx1:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "86D1FDAD-C594-43D9-9BF6-F7461177AB91",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_tx2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE9D4A55-A232-4AF2-B7E9-CD58D7D17479",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_tx2_4gb:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "71994F94-5279-4107-99F5-48990AE0C686",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_tx2_nx:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "64C3FB58-08AA-4FE4-97BE-21B254BA229F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_tx2i:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5DF55ABB-1B4F-452E-9D84-C01A638F88A0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:developer_kit:*:*:*:*:*",
              "matchCriteriaId": "3E54B955-F0E2-44BD-9B8C-3C788BBCF2A9",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:production:*:*:*:*:*",
              "matchCriteriaId": "3E0C93C3-26F6-48E4-BADA-4DB05A7BA9D1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Trusty (the trusted OS produced by NVIDIA for Jetson devices) driver contains a vulnerability in the NVIDIA OTE protocol message parsing code where an integer overflow in a malloc() size calculation leads to a buffer overflow on the heap, which might result in information disclosure, escalation of privileges, and denial of service."
    },
    {
      "lang": "es",
      "value": "El controlador Trusty (el Sistema Operativo confiable producido por NVIDIA para los dispositivos Jetson) contiene una vulnerabilidad en el c\u00f3digo de an\u00e1lisis de mensajes del protocolo OTE de NVIDIA en la que un desbordamiento de enteros en el c\u00e1lculo del tama\u00f1o de malloc() conlleva un desbordamiento del b\u00fafer en la pila, que puede resultar en una divulgaci\u00f3n de informaci\u00f3n, escalada de privilegios y una denegaci\u00f3n de servicio"
    }
  ],
  "id": "CVE-2021-34372",
  "lastModified": "2024-11-21T06:10:15.447",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0,
        "source": "psirt@nvidia.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-22T22:15:08.947",
  "references": [
    {
      "source": "psirt@nvidia.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5205"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5205"
    }
  ],
  "sourceIdentifier": "psirt@nvidia.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.