Vulnerability · Published Apr 27, 2022 · Assigned by nvidia

CVE-2022-28196

Medium 4.6

In plain English

A medium-severity improper input validation in Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX2 NX, Jetson TX2 series from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 84.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function, where insufficient validation of untrusted data may allow a local attacker with elevated privileges to cause a memory buffer overflow, which may lead to code execution, limited loss of Integrity, and limited denial of service. The scope of impact can extend to other components.

Affected products (as reported)

Vendor	Product	Versions
NVIDIA	Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX2 NX, Jetson TX2 series	All 32.x versions prior to 32.7.2

Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L

References

https://nvidia.custhelp.com/app/answers/detail/a_id/5343 x_refsource_MISC