CVE-2022-28196
4.6
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
Exploitability: 1.5 / Impact: 2.7
Source: NVD
Description
NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function, where insufficient validation of untrusted data may allow a local attacker with elevated privileges to cause a memory buffer overflow, which may lead to code execution, limited loss of Integrity, and limited denial of service. The scope of impact can extend to other components.
Affected (1)
Products: Nvidia: Jetson Linux
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 32.7.2 |
| Running on/with | Platform Versions |
|---|---|
Nvidia Jetson Agx Xavier | All versions |
Nvidia Jetson Tx2 | All versions |
Nvidia Jetson Tx2 Nx | All versions |
Nvidia Jetson Xavier Nx | All versions |
Related CWEs
CWE-20
Improper Input Validation
The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly.
CWE-787
Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.