Vulnerability · Published Apr 27, 2022 · Assigned by nvidia

CVE-2022-28197

Medium 5.0

In plain English

A medium-severity integer overflow in Jetson AGX Xavier series, Jetson Xavier NX from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_mount function, where Insufficient validation of untrusted data may allow a highly privileged local attacker to cause an integer overflow. This difficult-to-exploit vulnerability may lead to code execution, escalation of privileges, limited denial of service, and some impact to confidentiality and integrity. The scope of impact can extend to other components.

Affected products (as reported)

Vendor	Product	Versions
NVIDIA	Jetson AGX Xavier series, Jetson Xavier NX	All 32.x versions prior to 32.7.2

Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5343 x_refsource_MISC