Bugs in NVIDIA’s Jetson Chipset Opens Door to DoS Attacks, Data Theft

Flaws impacting thousands and thousands of internet of things (IoT) products operating NVIDIA’s Jetson chips open up the doorway for a selection of hacks, together with denial-of-support (DoS) attacks or the siphoning of details.

NVIDIA introduced patches addressing 9 higher-severity vulnerabilities which includes 8 more bugs of a lot less severity. The patches fix a large swath of NVIDIA’s chipsets usually applied for embedded computing programs, machine-discovering purposes and autonomous products this kind of as robots and drones.
Impacted goods include Jetson chipset series AGX Xavier, Xavier NX/TX1, Jetson TX2 (which include Jetson TX2 NX), and Jetson Nano equipment (like Jetson Nano 2GB) identified in the NVIDIA JetPack application builders package. The patches were delivered as section of NVIDIA’s June security bulletin, unveiled Friday.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Most Important Patch

The most severe bug, tracked as CVE‑2021‑34372, opens the Jetson framework to a buffer-overflow attack by an adversary. According to the NVIDIA security bulletin, the attacker would need to have network entry to a procedure to have out an attack, but the company warned the vulnerability is not elaborate to exploit and that an adversary with minor to reduced accessibility rights could start it. It added that an attack could give an adversary persistent obtain to components – other than the NVIDIA chipset specific – and let a hacker to manipulate and or sabotage a qualified program.

“[The Jetson] driver has a vulnerability in the NVIDIA OTE protocol message parsing code exactly where an integer overflow in a malloc() size calculation prospects to a buffer overflow on the heap, which could outcome in data disclosure, escalation of privileges and denial of support (DoS),” in accordance to the security bulletin, posted on Friday.

Oblivious transfer extensions (OTE) are lower-level cryptographic algorithms utilised by Jetson chipsets to process non-public-established-intersection protocols used to safe data as the chip procedures data.

Higher-Severity Roundup

Other significant-severity bugs patched by NVIDIA consist of vulnerabilities with severity rankings of between 7.9 and 7, which include CVE‑2021‑34373, CVE‑2021‑34374, CVE‑2021‑34375, CVE‑2021‑34376,  CVE‑2021‑34377, CVE‑2021‑34378, CVE‑2021‑34379 and CVE‑2021‑34380. 6 of the bugs, if exploited, could allow for a neighborhood attacker to cause a DoS attack.

One of the bugs (CVE‑2021‑34373), with a 7.9 severity ranking, impacts Jetson’s dependable Linux kernel and opens the door to a heap-centered buffer overflow attack. This kind attack is directed at the chip’s heap information memory framework, wherever the element is manipulated to deliver faults.

“Trusty trusted Linux kernel (TLK) includes a vulnerability in the NVIDIA TLK kernel where by a lack of heap hardening could trigger heap overflows, which could lead to data disclosure and denial of support,” NVIDIA wrote.

Other than firmware, the chipmaker issued patches (CVE‑2021‑34372 by means of CVE‑2021‑34397) to deal with endpoint application for Jetson TX1, TX2 sequence, TX2 NX, AGX Xavier sequence, Xavier NX, Nano and Nano 2GB. For those people bugs, NVIDIA credited bug hunter Frédéric Perriot of the Apple Media Goods RedTeam for reporting the issues.

“[Updates address] security issues that may perhaps guide to escalation of privileges, denial of support and information disclosure. To defend your program, obtain and put in the latest Debian packages from the APT repositories,” NVIDIA wrote.

Be a part of Threatpost for “Tips and Practices for Much better Danger Hunting” — a Are living party on Wed., June 30 at 2:00 PM ET in partnership with Palo Alto Networks. Master from Palo Alto’s Device 42 authorities the finest way to hunt down threats and how to use automation to assistance. Register HERE for totally free!