CVE-2021-34389
Vulnerability from cvelistv5
Published
2021-06-21 21:35
Modified
2024-08-04 00:12
Severity ?
EPSS score ?
Summary
Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can allow a local user through a malicious client to access memory from the heap in the TrustZone, which may lead to information disclosure.
References
Impacted products
Vendor | Product | Version | |
---|---|---|---|
▼ | NVIDIA | NVIDIA Jetson, TX2 series, TX2 NX, AGX Xavier series, Xavier NX |
Version: All Jetson Linux versions prior to r32.5.1 |
|
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-04T00:12:50.025Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5205", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "NVIDIA Jetson, TX2 series, TX2 NX, AGX Xavier series, Xavier NX", vendor: "NVIDIA", versions: [ { status: "affected", version: "All Jetson Linux versions prior to r32.5.1", }, ], }, ], descriptions: [ { lang: "en", value: "Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can allow a local user through a malicious client to access memory from the heap in the TrustZone, which may lead to information disclosure.", }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, }, ], problemTypes: [ { descriptions: [ { description: "information disclosure", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2021-07-16T22:50:44", orgId: "9576f279-3576-44b5-a4af-b9a8644b2de6", shortName: "nvidia", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5205", }, ], source: { discovery: "UNKNOWN", }, x_generator: { engine: "Vulnogram 0.0.9", }, x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "psirt@nvidia.com", ID: "CVE-2021-34389", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "NVIDIA Jetson, TX2 series, TX2 NX, AGX Xavier series, Xavier NX", version: { version_data: [ { version_value: "All Jetson Linux versions prior to r32.5.1", }, ], }, }, ], }, vendor_name: "NVIDIA", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can allow a local user through a malicious client to access memory from the heap in the TrustZone, which may lead to information disclosure.", }, ], }, generator: { engine: "Vulnogram 0.0.9", }, impact: { cvss: { attackComplexity: "LOW", attackVector: "LOCAL", availabilityImpact: "NONE", baseScore: 5, baseSeverity: "MEDIUM", confidentialityImpact: "HIGH", integrityImpact: "NONE", privilegesRequired: "LOW", scope: "UNCHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", version: "3.1", }, }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "information disclosure", }, ], }, ], }, references: { reference_data: [ { name: "https://nvidia.custhelp.com/app/answers/detail/a_id/5205", refsource: "CONFIRM", url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5205", }, ], }, source: { discovery: "UNKNOWN", }, }, }, }, cveMetadata: { assignerOrgId: "9576f279-3576-44b5-a4af-b9a8644b2de6", assignerShortName: "nvidia", cveId: "CVE-2021-34389", datePublished: "2021-06-21T21:35:19", dateReserved: "2021-06-09T00:00:00", dateUpdated: "2024-08-04T00:12:50.025Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"32.5.1\", \"matchCriteriaId\": \"E8941F71-0292-414E-AEA5-DD55EA3C2009\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_agx_xavier_16gb:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0E081CB-B6EC-42DC-BA04-BCA13C17D190\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4F92D471-8E65-41FC-A5DE-255136F6F989\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_agx_xavier_8gb:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E29459F7-997A-4B87-9164-6E3B5158ADC3\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_tx2:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DE9D4A55-A232-4AF2-B7E9-CD58D7D17479\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_tx2_4gb:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"71994F94-5279-4107-99F5-48990AE0C686\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_tx2_nx:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"64C3FB58-08AA-4FE4-97BE-21B254BA229F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_tx2i:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5DF55ABB-1B4F-452E-9D84-C01A638F88A0\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:developer_kit:*:*:*:*:*\", \"matchCriteriaId\": \"3E54B955-F0E2-44BD-9B8C-3C788BBCF2A9\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:production:*:*:*:*:*\", \"matchCriteriaId\": \"3E0C93C3-26F6-48E4-BADA-4DB05A7BA9D1\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can allow a local user through a malicious client to access memory from the heap in the TrustZone, which may lead to information disclosure.\"}, {\"lang\": \"es\", \"value\": \"Trusty contiene una vulnerabilidad en el c\\u00f3digo de an\\u00e1lisis de mensajes del protocolo NVIDIA OTE, que est\\u00e1 presente en todas las TA. Una comprobaci\\u00f3n de l\\u00edmites incorrecta puede permitir a un usuario local, a trav\\u00e9s de un cliente malicioso, acceder a la memoria de la pila de la TrustZone, lo que puede conducir a la divulgaci\\u00f3n de informaci\\u00f3n\"}]", id: "CVE-2021-34389", lastModified: "2024-11-21T06:10:17.770", metrics: "{\"cvssMetricV31\": [{\"source\": \"psirt@nvidia.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\", \"baseScore\": 5.0, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.3, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\", \"baseScore\": 5.0, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.3, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:M/Au:N/C:P/I:N/A:N\", \"baseScore\": 1.9, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.4, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}", published: "2021-06-21T22:15:07.833", references: "[{\"url\": \"https://nvidia.custhelp.com/app/answers/detail/a_id/5205\", \"source\": \"psirt@nvidia.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://nvidia.custhelp.com/app/answers/detail/a_id/5205\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]", sourceIdentifier: "psirt@nvidia.com", vulnStatus: "Modified", weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-401\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2021-34389\",\"sourceIdentifier\":\"psirt@nvidia.com\",\"published\":\"2021-06-21T22:15:07.833\",\"lastModified\":\"2024-11-21T06:10:17.770\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can allow a local user through a malicious client to access memory from the heap in the TrustZone, which may lead to information disclosure.\"},{\"lang\":\"es\",\"value\":\"Trusty contiene una vulnerabilidad en el código de análisis de mensajes del protocolo NVIDIA OTE, que está presente en todas las TA. Una comprobación de límites incorrecta puede permitir a un usuario local, a través de un cliente malicioso, acceder a la memoria de la pila de la TrustZone, lo que puede conducir a la divulgación de información\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@nvidia.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.3,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.3,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":1.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.4,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"32.5.1\",\"matchCriteriaId\":\"E8941F71-0292-414E-AEA5-DD55EA3C2009\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_agx_xavier_16gb:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0E081CB-B6EC-42DC-BA04-BCA13C17D190\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F92D471-8E65-41FC-A5DE-255136F6F989\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_agx_xavier_8gb:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E29459F7-997A-4B87-9164-6E3B5158ADC3\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_tx2:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE9D4A55-A232-4AF2-B7E9-CD58D7D17479\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_tx2_4gb:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71994F94-5279-4107-99F5-48990AE0C686\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_tx2_nx:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"64C3FB58-08AA-4FE4-97BE-21B254BA229F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_tx2i:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5DF55ABB-1B4F-452E-9D84-C01A638F88A0\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:developer_kit:*:*:*:*:*\",\"matchCriteriaId\":\"3E54B955-F0E2-44BD-9B8C-3C788BBCF2A9\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:production:*:*:*:*:*\",\"matchCriteriaId\":\"3E0C93C3-26F6-48E4-BADA-4DB05A7BA9D1\"}]}]}],\"references\":[{\"url\":\"https://nvidia.custhelp.com/app/answers/detail/a_id/5205\",\"source\":\"psirt@nvidia.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://nvidia.custhelp.com/app/answers/detail/a_id/5205\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}", }, }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.