Buffer overflow in Jetson Xavier NX and Jetson AGX Xavier series - CVE-2022-28194
Published: April 26, 2022
Vulnerability identifier: #VU62604
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-28194
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to escalate privileges on the system.
The vulnerability exists due to a boundary error in the Cboot module tegrabl_cbo.c. A local attacker with physical access to the system can trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability requires that TFTP is enabled.
Affected software
Jetson Xavier NX
Jetson AGX Xavier series
Jetson AGX Xavier series
How to mitigate CVE-2022-28194
Install updates from vendor's website.
Jetson Xavier NX - update to 32.7.2
Jetson AGX Xavier series - update to 32.7.2
Jetson AGX Xavier series - update to 32.7.2