Vulnerability Name:

CVE-2021-1108 (CCN-207248)

Assigned:2020-11-12
Published:2021-08-04
Updated:2022-07-08
Summary:NVIDIA Linux kernel distributions contain a vulnerability in FuSa Capture (VI/ISP), where integer underflow due to lack of input validation may lead to complete denial of service, partial integrity, and serious confidentiality loss for all processes in the system.
CVSS v3 Severity:7.3 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
6.4 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): Low
Availibility (A): High
8.7 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H)
7.6 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): Low
Availibility (A): High
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.4 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:P/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Partial
Availibility (A): Complete
Vulnerability Type:CWE-191
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-1108

Source: XF
Type: UNKNOWN
nvidia-cve20211108-code-exec(207248)

Source: CCN
Type: NVIDIA Security Bulletin Answer ID 5216
NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, Jetson TX1, Jetson TX2 Series (including Jetson TX2 NX), and Jetson Nano (including Jetson Nano 2GB)- August 2021

Source: MISC
Type: Vendor Advisory
https://nvidia.custhelp.com/app/answers/detail/a_id/5216

Source: CONFIRM
Type: Vendor Advisory
N/A

Vulnerable Configuration:Configuration 1:
  • cpe:/o:nvidia:jetson_linux:*:*:*:*:*:*:*:* (Version >= 32.1 and < 32.6.1)
  • AND
  • cpe:/h:nvidia:jetson_tx1:-:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_tx2:-:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_agx_xavier:-:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_xavier_nx:-:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_nano:-:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_nano_2gb:-:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_tx2_nx:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/a:nvidia:shield_experience:*:*:*:*:*:*:*:* (Version < 9.0)
  • AND
  • cpe:/h:nvidia:shield_tv:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:nvidia:jetson_tx1:*:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_xavier_nx:-:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_nano:-:*:-:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_nano_2gb:-:*:*:*:*:*:*:*
  • OR cpe:/h:nvidia:jetson_tx2_nx:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    nvidia jetson linux *
    nvidia jetson tx1 -
    nvidia jetson tx2 -
    nvidia jetson agx xavier -
    nvidia jetson xavier nx -
    nvidia jetson nano -
    nvidia jetson nano 2gb -
    nvidia jetson tx2 nx -
    nvidia shield experience *
    nvidia shield tv -
    nvidia jetson tx1 *
    nvidia jetson xavier nx -
    nvidia jetson nano -
    nvidia jetson nano 2gb -
    nvidia jetson tx2 nx -