Buffer overflow in Jetson Xavier NX and Jetson AGX Xavier series - CVE-2022-28193
Published: April 26, 2022
Vulnerability identifier: #VU62603
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-28193
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to escalate privileges on the system.
The vulnerability exists due to a boundary error in the Cboot module tegrabl_cbo.c. A local attacker with physical access to the system can trigger memory corruption and execute arbitrary code with elevated privileges.
Affected software
Jetson Xavier NX
Jetson AGX Xavier series
Jetson AGX Xavier series
How to mitigate CVE-2022-28193
Install updates from vendor's website.
Jetson Xavier NX - update to 32.7.2
Jetson AGX Xavier series - update to 32.7.2
Jetson AGX Xavier series - update to 32.7.2