Vulnerability · Published Apr 27, 2022 · Assigned by nvidia

CVE-2022-28195

Medium 5.7

In plain English

A medium-severity improper input validation in Jetson AGX Xavier series, Jetson Xavier NX from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)0.2%top 84.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function, where insufficient validation of untrusted data may allow a highly privileged local attacker to cause a integer overflow, which may lead to code execution, escalation of privileges, limited denial of service, and some impact to confidentiality and integrity. The scope of impact can extend to other components.

Affected products (as reported)

Vendor	Product	Versions
NVIDIA	Jetson AGX Xavier series, Jetson Xavier NX	All 32.x versions prior to 32.7.2

Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5343 x_refsource_MISC