VAR-201704-0631

Vulnerability from variot - Updated: 2025-04-20 19:45

An elevation of privilege vulnerability in the NVIDIA boot and power management processor driver could enable a local malicious application to execute arbitrary code within the context of the boot and power management processor. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.18. Android ID:A-34115304. References: N-CVE-2017-0329. This vulnerability Android ID: A-34115304 and NVIDIA N-CVE-2017-0329 It is published asInformation is obtained, information is altered, and service operation is disrupted (DoS) An attack may be carried out. GooglePixelC is a tablet. NVIDIA GPUdriver is one of the NVIDIA graphics processor driver components used in it. GooglePixelC has a privilege escalation vulnerability that allows an attacker to exploit a vulnerability for privilege escalation. Google Pixel C is prone to a privilege-escalation vulnerability. Attackers can exploit this issue to execute arbitrary code with elevated privileges within the context of the process. This issue is being tracked by Android Bug ID A-34115304

Show details on source website
To clipboard 

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "kernel",
        "scope": "eq",
        "trust": 2.4,
        "vendor": "linux",
        "version": "3.18"
      },
      {
        "_id": null,
        "model": "android",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "google",
        "version": "0"
      },
      {
        "_id": null,
        "model": "pixel c",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "google",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370"
      },
      {
        "db": "BID",
        "id": "97353"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-0329"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:linux:linux_kernel",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Gengjia Chen and pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd.",
    "sources": [
      {
        "db": "BID",
        "id": "97353"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-0329",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.9,
            "id": "CVE-2017-0329",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.6,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 4.9,
            "id": "CNVD-2017-05370",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.0,
            "id": "CVE-2017-0329",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-0329",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-0329",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-05370",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201704-242",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-0329",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-0329"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-0329"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "An elevation of privilege vulnerability in the NVIDIA boot and power management processor driver could enable a local malicious application to execute arbitrary code within the context of the boot and power management processor. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.18. Android ID:A-34115304. References: N-CVE-2017-0329. This vulnerability Android ID: A-34115304 and NVIDIA N-CVE-2017-0329 It is published asInformation is obtained, information is altered, and service operation is disrupted (DoS) An attack may be carried out. GooglePixelC is a tablet. NVIDIA GPUdriver is one of the NVIDIA graphics processor driver components used in it. GooglePixelC has a privilege escalation vulnerability that allows an attacker to exploit a vulnerability for privilege escalation. Google Pixel C is prone to a privilege-escalation vulnerability. \nAttackers can exploit this issue to execute arbitrary code with elevated  privileges within  the context of the process. \nThis issue is being tracked by Android Bug ID A-34115304",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-0329"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370"
      },
      {
        "db": "BID",
        "id": "97353"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-0329"
      }
    ],
    "trust": 2.52
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-0329",
        "trust": 3.4
      },
      {
        "db": "BID",
        "id": "97353",
        "trust": 2.6
      },
      {
        "db": "SECTRACK",
        "id": "1038201",
        "trust": 1.7
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-0329",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-0329"
      },
      {
        "db": "BID",
        "id": "97353"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-0329"
      }
    ]
  },
  "id": "VAR-201704-0631",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "_id": null,
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370"
      }
    ]
  },
  "last_update_date": "2025-04-20T19:45:11.032000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "Android Security Bulletin-April 2017",
        "trust": 0.8,
        "url": "https://source.android.com/security/bulletin/2017-04-01"
      },
      {
        "title": "Linux Kernel Archives",
        "trust": 0.8,
        "url": "http://www.kernel.org/"
      },
      {
        "title": "Patch for GooglePixelC privilege escalation vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/92708"
      },
      {
        "title": "Android NVIDIA boot and power management processor Fixes for driver permission and access control vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74426"
      },
      {
        "title": "Android Security Bulletins: Android Security Bulletin\u2014April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins\u0026qid=025639006d2b3a5a3351c0120c1dcfe8"
      },
      {
        "title": "CVE-Study",
        "trust": 0.1,
        "url": "https://github.com/thdusdl1219/CVE-Study "
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-0329"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-264",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-0329"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.4,
        "url": "http://www.securityfocus.com/bid/97353"
      },
      {
        "trust": 2.1,
        "url": "https://source.android.com/security/bulletin/2017-04-01.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.securitytracker.com/id/1038201"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-0329"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-0329"
      },
      {
        "trust": 0.6,
        "url": "https://source.android.com/security/bulletin/2017-04-01"
      },
      {
        "trust": 0.3,
        "url": "http://code.google.com/android/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-0329"
      },
      {
        "db": "BID",
        "id": "97353"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-0329"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-05370",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-0329",
        "ident": null
      },
      {
        "db": "BID",
        "id": "97353",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2017-0329",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2017-04-26T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-05370",
        "ident": null
      },
      {
        "date": "2017-04-05T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-0329",
        "ident": null
      },
      {
        "date": "2017-04-03T00:00:00",
        "db": "BID",
        "id": "97353",
        "ident": null
      },
      {
        "date": "2017-05-08T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-002881",
        "ident": null
      },
      {
        "date": "2017-04-05T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201704-242",
        "ident": null
      },
      {
        "date": "2017-04-05T14:59:00.260000",
        "db": "NVD",
        "id": "CVE-2017-0329",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2017-04-26T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-05370",
        "ident": null
      },
      {
        "date": "2019-10-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-0329",
        "ident": null
      },
      {
        "date": "2017-04-04T15:04:00",
        "db": "BID",
        "id": "97353",
        "ident": null
      },
      {
        "date": "2017-05-08T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-002881",
        "ident": null
      },
      {
        "date": "2019-10-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201704-242",
        "ident": null
      },
      {
        "date": "2025-04-20T01:37:25.860000",
        "db": "NVD",
        "id": "CVE-2017-0329",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "NVIDIA Vulnerabilities related to authorization, authority, and access control in boot and power management processor drivers",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-002881"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "permissions and access control issues",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201704-242"
      }
    ],
    "trust": 0.6
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.