CVE-2017-6264

{"id": "CVE-2017-6264", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2017-11-14T17:29:00.383", "references": [{"url": "http://www.securityfocus.com/bid/101744", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@nvidia.com"}, {"url": "https://source.android.com/security/bulletin/2017-11-01", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An elevation of privilege vulnerability exists in the NVIDIA GPU driver (gm20b_clk_throt_set_cdev_state), where an out of bound memory read is used as a function pointer could lead to code execution in the kernel.This issue is rated as high because it could allow a local malicious application to execute arbitrary code within the context of a privileged process. Product: Android. Version: N/A. Android ID: A-34705430. References: N-CVE-2017-6264."}, {"lang": "es", "value": "Existe una vulnerabilidad de elevaci\u00f3n de privilegios en el controlador NVIDIA GPU (gm20b_clk_throt_set_cdev_state), en el que una lectura de memoria fuera de l\u00edmites se emplea como puntero de funci\u00f3n. Esta vulnerabilidad podr\u00eda desembocar en la ejecuci\u00f3n de c\u00f3digo en el kernel. Este problema se ha clasificado como alto debido a que podr\u00eda permitir que una aplicaci\u00f3n local maliciosa ejecute c\u00f3digo arbitrario en el contexto de un proceso con privilegios. Producto: Android. Versi\u00f3n: N/A. Android ID: A-34705430. Referencias: N-CVE-2017-6264."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}