Vulnerability in NVIDIA Tegra Chipsets Allows for Code Execution

itman · Apr 25, 2018

A vulnerability in NVIDIA's Tegra chipsets allows for the execution of custom code on locked-down devices, security researcher Kate Temkin reveals.

Dubbed Fusée Gelée, this exploit leverages a coldboot vulnerability through which an attacker could achieve full, unauthenticated arbitrary code execution from an early bootROM context via Tegra Recovery Mode (RCM), the security researcher says.

The code is executed on the Boot and Power Management Processor (BPMP) before any lock-outs take effect, which results in the compromise of the entire root-of-trust for each processor, while also allowing for the exfiltration of secrets.

Nintendo Switch is one of the affected devices, and Temkin, who works with hacking project ReSwitched, is building customized Switch firmware called Atmosphère, which takes advantage of Fusée Gelée.

The vulnerability is believed to impact all Tegra SoCs released prior to the T186 / X2.
Click to expand...

https://www.securityweek.com/vulnerability-nvidia-tegra-chipsets-allows-code-execution

guest · Jul 19, 2019

Bug in NVIDIA’s Tegra Chipset Opens Door to Malicious Code Execution
July 19, 2019
https://threatpost.com/nvidias-tegra-chipset-attack/146561/

A flaw impacting millions of mobile and internet of things (IoT) devices running NVIDIA’s Tegra processor opens the door for a variety of attacks, including device hijacking or siphoning of data.

The warning comes from researcher Triszka Balázs, who discovered the flaw and asserts that the bug “affects every single Tegra device released so far.” He also created a proof-of-concept (PoC), called Selfblow, to exploit the vulnerability. On Thursday, NVIDIA released a patch for the bug (CVE‑2019‑5680) via a security bulletin.

The researcher’s PoC leverages what is called a cold-boot attack. That is when sensitive data becomes available to attackers via a computer’s RAM because the machine wasn’t shut down properly.
“This is an untethered cold-boot exploit, and as far as I can tell it affects every single Tegra device released so far. [...]"
Click to expand...

On Twitter he wrote: “In the end @nvidia given me a CVE. CVE‑2019‑5680. It got a 7.7 score, but the correct one is 8.1, since it doesn’t require user interaction.”
Click to expand...

guest · Dec 6, 2019

NVIDIA Patches Severe Flaws in Mercedes Infotainment System Chips
December 6, 2019
https://www.bleepingcomputer.com/ne...-flaws-in-mercedes-infotainment-system-chips/

NVIDIA released security updates for six high severity vulnerabilities found in the Tegra Linux Driver Package (L4T) for Jetson AGX Xavier, TK1, TX1, TX2, and Nano chips used in Mercedes-Benz's MBUX infotainment system and Bosch self-driving computer systems.

These security flaws that could allow local attackers with various levels of user privileges to execute arbitrary code, escalate privileges, trigger denial-of-service (DoS) states, and launch information disclosure attacks against devices featuring unpatched chips.
The high severity vulnerabilities
Potential attackers could run code on devices with vulnerable chips by taking advantage of unpatched code execution flaws, while exploiting the vulnerabilities that lead to a DoS state can render them temporarily unusable.

The six high severity security issues NVIDIA fixed received base score ratings between 7.6 and 8.0, and are detailed in the table below with full descriptions and their assigned CVSS V3 Base Scores and Vectors.
Click to expand...

Security Bulletin: Jetson AGX Xavier, TK1, TX1, TX2, and Nano L4T- December 2019

Log in or Sign up

Vulnerability in NVIDIA Tegra Chipsets Allows for Code Execution

itman Registered Member

guest Guest

guest Guest

Log in or Sign up

Vulnerability in NVIDIA Tegra Chipsets Allows for Code Execution

itman Registered Member

guest Guest

guest Guest

Useful Searches