github - ghsa-xjr6-xhwq-23jv

ghsa-xjr6-xhwq-23jv

Vulnerability from github

Published

2022-05-24 19:11

Modified

2022-05-24 19:11

Severity ?

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Details

NVIDIA Linux kernel distributions contain a vulnerability in FuSa Capture (VI/ISP), where integer underflow due to lack of input validation may lead to complete denial of service, partial integrity, and serious confidentiality loss for all processes in the system.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2021-1108",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-191",
         "CWE-20",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2021-08-11T22:15:00Z",
      severity: "HIGH",
   },
   details: "NVIDIA Linux kernel distributions contain a vulnerability in FuSa Capture (VI/ISP), where integer underflow due to lack of input validation may lead to complete denial of service, partial integrity, and serious confidentiality loss for all processes in the system.",
   id: "GHSA-xjr6-xhwq-23jv",
   modified: "2022-05-24T19:11:02Z",
   published: "2022-05-24T19:11:02Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2021-1108",
      },
      {
         type: "WEB",
         url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5216",
      },
      {
         type: "WEB",
         url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5259",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
         type: "CVSS_V3",
      },
   ],
}

cve-2021-1108

Vulnerability from cvelistv5

Published

2021-08-11 21:33

Modified

2024-08-03 15:55

Severity ?

7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Summary

References

▼	URL	Tags
	https://nvidia.custhelp.com/app/answers/detail/a_id/5216	x_refsource_MISC
	https://nvidia.custhelp.com/app/answers/detail/a_id/5259	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

NVIDIA

Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX2 series, Jetson TX2 NX, Jetson Nano, Jetson Nano 2GB, Jetson TX1

Version: All Jetson Linux versions prior to r32.6.1

NVIDIA

Shield TV

Version: All Shield TV versions prior to SE 9.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T15:55:18.642Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5216",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5259",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX2 series, Jetson TX2 NX, Jetson Nano, Jetson Nano 2GB, Jetson TX1",
               vendor: "NVIDIA",
               versions: [
                  {
                     status: "affected",
                     version: "All Jetson Linux versions prior to r32.6.1",
                  },
               ],
            },
            {
               product: "Shield TV",
               vendor: "NVIDIA",
               versions: [
                  {
                     status: "affected",
                     version: "All Shield TV versions prior to SE 9.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "NVIDIA Linux kernel distributions contain a vulnerability in FuSa Capture (VI/ISP), where integer underflow due to lack of input validation may lead to complete denial of service, partial integrity, and serious confidentiality loss for all processes in the system.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "denial of service, partial integrity, and confidentiality loss",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-01-19T16:56:12",
            orgId: "9576f279-3576-44b5-a4af-b9a8644b2de6",
            shortName: "nvidia",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5216",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5259",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@nvidia.com",
               ID: "CVE-2021-1108",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX2 series, Jetson TX2 NX, Jetson Nano, Jetson Nano 2GB, Jetson TX1",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All Jetson Linux versions prior to r32.6.1",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Shield TV",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All Shield TV versions prior to SE 9.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "NVIDIA",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "NVIDIA Linux kernel distributions contain a vulnerability in FuSa Capture (VI/ISP), where integer underflow due to lack of input validation may lead to complete denial of service, partial integrity, and serious confidentiality loss for all processes in the system.",
                  },
               ],
            },
            impact: {
               cvss: {
                  baseScore: 7.3,
                  baseSeverity: "High",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                  version: "3.1",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "denial of service, partial integrity, and confidentiality loss",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://nvidia.custhelp.com/app/answers/detail/a_id/5216",
                     refsource: "MISC",
                     url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5216",
                  },
                  {
                     name: "https://nvidia.custhelp.com/app/answers/detail/a_id/5259",
                     refsource: "MISC",
                     url: "https://nvidia.custhelp.com/app/answers/detail/a_id/5259",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "9576f279-3576-44b5-a4af-b9a8644b2de6",
      assignerShortName: "nvidia",
      cveId: "CVE-2021-1108",
      datePublished: "2021-08-11T21:33:01",
      dateReserved: "2020-11-12T00:00:00",
      dateUpdated: "2024-08-03T15:55:18.642Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted