SB2018071203 - Multiple vulnerabilities in nVidia SHIELD TV

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Memory corruption (CVE-ID: CVE-2017-6290)

The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists due to a flaw in the CORE DVFS Thermal driver in NVIDIA Tegra kernel. A local attacker can read from or write to a buffer using an index or pointer that references a memory location after the end of the buffer and gain elevated privileges or cause the service to crash.

2) Out-of-bounds write (CVE-ID: CVE-2017-6294)

The vulnerability allows a physical unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists due to a flaw in the logging driver in NVIDIA TLK TrustZone OS. A physical attacker can cause the software to write data after the end or before the beginning of the intended buffer and cause the service to crash or execute arbitrary code execution with elevated privileges.

3) Integer overflow (CVE-ID: CVE-2017-6292)

The vulnerability allows a physical unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists due to a flaw in the TA-to-TA communication handler in NVIDIA TLK TrustZone OS where the software performs a calculation. A physical attacker can  trigger integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value, and and cause the service to crash or execute arbitrary code execution with elevated privileges.

Remediation

Install update from vendor's website.

References

• http://nvidia.custhelp.com/app/answers/detail/a_id/4682