CVE-2021-34389

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-34389
Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can allow a local user through a malicious client to access memory from the heap in the TrustZone, which may lead to information disclosure.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5205 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*
OR cpe:2.3:h:nvidia:jetson_agx_xavier_16gb:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_agx_xavier_8gb:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_tx2:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_tx2_4gb:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_tx2_nx:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_tx2i:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:developer_kit:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:production:*:*:*:*:*
History

25 Aug 2021, 15:33

Type Values Removed Values Added
CVSS v2 : 2.1
v3 : 5.5 		v2 : 1.9
v3 : 5.0

16 Jul 2021, 23:15

Type Values Removed Values Added
Summary Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check leads to a memory leak of a portion of the heap situated after a stream buffer. Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. An incorrect bounds check can allow a local user through a malicious client to access memory from the heap in the TrustZone, which may lead to information disclosure.

29 Jun 2021, 13:41

Type Values Removed Values Added
References (CONFIRM) https://nvidia.custhelp.com/app/answers/detail/a_id/5205 - (CONFIRM) https://nvidia.custhelp.com/app/answers/detail/a_id/5205 - Vendor Advisory
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : 2.1
v3 : 5.5
CPE cpe:2.3:h:nvidia:jetson_tx2:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:production:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_agx_xavier_8gb:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_tx2_4gb:-:*:*:*:*:*:*:*
cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:developer_kit:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_tx2_nx:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_agx_xavier_16gb:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_tx2i:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_agx_xavier_32gb:-:*:*:*:*:*:*:*

21 Jun 2021, 22:23

Type Values Removed Values Added
New CVE
Information

Published : 2021-06-21 22:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-34389

Mitre link : CVE-2021-34389

CVE.ORG link : CVE-2021-34389

JSON object : View

Products Affected

nvidia

  • jetson_tx2_4gb
  • jetson_agx_xavier_32gb
  • jetson_agx_xavier_16gb
  • jetson_agx_xavier_8gb
  • jetson_tx2
  • jetson_linux
  • jetson_tx2i
  • jetson_xavier_nx
  • jetson_tx2_nx
CWE
CWE-401

Missing Release of Memory after Effective Lifetime