SB2018071203 - Multiple vulnerabilities in nVidia SHIELD TV
Published: July 12, 2018
Security Bulletin ID
SB2018071203
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Memory corruption (CVE-ID: CVE-2017-6290)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target system.
The weakness exists due to a flaw in the CORE DVFS Thermal driver in NVIDIA Tegra kernel. A local attacker can read from or write to a buffer using an index or pointer that references a memory location after the end of the buffer and gain elevated privileges or cause the service to crash.
2) Out-of-bounds write (CVE-ID: CVE-2017-6294)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a physical unauthenticated attacker to gain elevated privileges on the target system.
The weakness exists due to a flaw in the logging driver in NVIDIA TLK TrustZone OS. A physical attacker can cause the software to write data after the end or before the beginning of the intended buffer and cause the service to crash or execute arbitrary code execution with elevated privileges.
3) Integer overflow (CVE-ID: CVE-2017-6292)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a physical unauthenticated attacker to gain elevated privileges on the target system.
The weakness exists due to a flaw in the TA-to-TA communication handler in NVIDIA TLK TrustZone OS where the software performs a calculation. A physical attacker can trigger integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value, and and cause the service to crash or execute arbitrary code execution with elevated privileges.
Remediation
Install update from vendor's website.