cnvd - cnvd-2019-28487

CNVD-2019-28487

Vulnerability from cnvd - Published: 2019-08-22

Title

NVIDIA Jetson TX1和NVIDIA Jetson TX2加密问题漏洞

Description

NVIDIA Jetson TX2和NVIDIA Jetson TX1都是美国英伟达（NVIDIA）公司的产品。NVIDIA Jetson TX2是一款嵌入式系统开发模块。NVIDIA Jetson TX1是一款嵌入式系统开发模块。Linux for Tegra是运行在其中的一套Linux系统。 NVIDIA Jetson TX1和NVIDIA Jetson TX2存在加密问题漏洞。攻击者可利用该漏洞泄露信息。

Severity

中

Patch Name

NVIDIA Jetson TX1和NVIDIA Jetson TX2加密问题漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://nvidia.custhelp.com/app/answers/detail/a_id/4787

Reference

https://nvd.nist.gov/vuln/detail/CVE-2019-5672

Impacted products

Name
['NVIDIA Jetson TX1 <R28.3', 'NVIDIA Jetson TX2 <R28.3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-5672",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5672"
    }
  },
  "description": "NVIDIA Jetson TX2\u548cNVIDIA Jetson TX1\u90fd\u662f\u7f8e\u56fd\u82f1\u4f1f\u8fbe\uff08NVIDIA\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002NVIDIA Jetson TX2\u662f\u4e00\u6b3e\u5d4c\u5165\u5f0f\u7cfb\u7edf\u5f00\u53d1\u6a21\u5757\u3002NVIDIA Jetson TX1\u662f\u4e00\u6b3e\u5d4c\u5165\u5f0f\u7cfb\u7edf\u5f00\u53d1\u6a21\u5757\u3002Linux for Tegra\u662f\u8fd0\u884c\u5728\u5176\u4e2d\u7684\u4e00\u5957Linux\u7cfb\u7edf\u3002\n\nNVIDIA Jetson TX1\u548cNVIDIA Jetson TX2\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6cc4\u9732\u4fe1\u606f\u3002",
  "discovererName": "Jesse Raffa",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://nvidia.custhelp.com/app/answers/detail/a_id/4787",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-28487",
  "openTime": "2019-08-22",
  "patchDescription": "NVIDIA Jetson TX2\u548cNVIDIA Jetson TX1\u90fd\u662f\u7f8e\u56fd\u82f1\u4f1f\u8fbe\uff08NVIDIA\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002NVIDIA Jetson TX2\u662f\u4e00\u6b3e\u5d4c\u5165\u5f0f\u7cfb\u7edf\u5f00\u53d1\u6a21\u5757\u3002NVIDIA Jetson TX1\u662f\u4e00\u6b3e\u5d4c\u5165\u5f0f\u7cfb\u7edf\u5f00\u53d1\u6a21\u5757\u3002Linux for Tegra\u662f\u8fd0\u884c\u5728\u5176\u4e2d\u7684\u4e00\u5957Linux\u7cfb\u7edf\u3002\r\n\r\nNVIDIA Jetson TX1\u548cNVIDIA Jetson TX2\u5b58\u5728\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6cc4\u9732\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "NVIDIA Jetson TX1\u548cNVIDIA Jetson TX2\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "NVIDIA Jetson TX1 \u003cR28.3",
      "NVIDIA Jetson TX2 \u003cR28.3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-5672",
  "serverity": "\u4e2d",
  "submitTime": "2019-04-15",
  "title": "NVIDIA Jetson TX1\u548cNVIDIA Jetson TX2\u52a0\u5bc6\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2019-5672 (GCVE-0-2019-5672)

Vulnerability from cvelistv5 – Published: 2019-04-11 16:37 – Updated: 2024-08-04 20:01

Summary

NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the sample rootfs are not replaced by unique host keys after sample rootsfs generation and flashing, which may lead to information disclosure.

Severity ?

No CVSS data available.

CWE

Information disclosure

Assigner

nvidia

References

URL

Tags

https://nvidia.custhelp.com/app/answers/detail/a_…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	NVIDIA	Jetson TX1 and TX2	Affected: All versions prior to version R28.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:01:51.975Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/4787"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Jetson TX1 and TX2",
          "vendor": "NVIDIA",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to version R28.3"
            }
          ]
        }
      ],
      "datePublic": "2019-04-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the sample rootfs are not replaced by unique host keys after sample rootsfs generation and flashing, which may lead to information disclosure."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-17T14:43:21",
        "orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
        "shortName": "nvidia"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/4787"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@nvidia.com",
          "ID": "CVE-2019-5672",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Jetson TX1 and TX2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior to version R28.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NVIDIA"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior to R28.3) where the Secure Shell (SSH) keys provided in the sample rootfs are not replaced by unique host keys after sample rootsfs generation and flashing, which may lead to information disclosure."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://nvidia.custhelp.com/app/answers/detail/a_id/4787",
              "refsource": "CONFIRM",
              "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/4787"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
    "assignerShortName": "nvidia",
    "cveId": "CVE-2019-5672",
    "datePublished": "2019-04-11T16:37:26",
    "dateReserved": "2019-01-07T00:00:00",
    "dateUpdated": "2024-08-04T20:01:51.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-28487

CVE-2019-5672 (GCVE-0-2019-5672)

Tags

Sightings

Nomenclature