SB2022011220 - Multiple vulnerabilities in NVIDIA SHIELD TV
Published: January 12, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Security restrictions bypass (CVE-ID: CVE-2021-1106)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists in nvmap in NVIDIA Linux kernel distributions due to possibility to perform writes to read-only buffers. A local user can execute arbitrary code with kernel privileges.
2) Improper access control (CVE-ID: CVE-2021-1107)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper access control restrictions in nvmap NVMAP_IOC_WRITE* paths. A local user can execute arbitrary code with kernel privileges.
3) Integer overflow (CVE-ID: CVE-2021-1108)
The vulnerability allows a local user to escalate privileges on the system.
4) NULL pointer dereference (CVE-ID: CVE-2021-1112)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in nvmap. A local userr can pass specially crafted data to the system and perform a denial of service (DoS) attack.
5) Improper access control (CVE-ID: CVE-2021-34401)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to improper access restrictions in nvmap NVGPU_IOCTL_CHANNEL_SET_ERROR_NOTIFIER. A malicious application can bypass implemented security restrictions and escalate privileges on the system.
6) Buffer overflow (CVE-ID: CVE-2021-34402)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to a boundary error within NVIDIA NVDEC in NVIDIA Tegra kernel driver. A malicious application can trigger memory corruption and execute arbitrary code with elevated privileges.
7) Use-after-free (CVE-ID: CVE-2021-34403)
The vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the nvmap ioctl. A malicious application can trigger a use-after-free error and execute arbitrary code with elevated privileges.
8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2021-34404)
The vulnerability allows an attacker to compromise the affected system.
The vulnerability exists due to failure to limit access AHB-DMA in BROM, as distributed with Android images for T210 provided by NVIDIA. An attacker with physical access to device execute arbitrary actions beyond the security scope of BROM.
9) NULL pointer dereference (CVE-ID: CVE-2021-34405)
The vulnerability allows a malicious application to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in in TrustZone’s TEE_Malloc function. A malicious application can pass specially crafted data to the application and perform a denial of service (DoS) attack.
10) NULL pointer dereference (CVE-ID: CVE-2021-34406)
The vulnerability allows a malicious application to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in NVHost. A malicious application can trigger a race condition and reboot the system, resulting in DoS.
Remediation
Install update from vendor's website.