NVidia Jetson SoC Vulnerabilities Expose Devices to Data Theft

Last Friday chipmaker NVidia released patches addressing a range of vulnerabilities and bugs in the company's Jetson system on chip (SoC) framework.

The company issues a security bulletin on April 18, publishing the full details on all addressed vulnerabilities and bugs that the patches concern. Among those were nine serious vulnerabiltiies and another eight bugs that did not have such a high security impact.

The vulnerabilities allowed potential bad actors to execute denial of service attacks or exfiltrate information from the devices.

The Jetson SoC is usually found in IoT devices, robots and drones as well as in various embedded systems with different applications. The list of impacted Jetson family products that have now had those issues patched include the AGX Xavier, Xavier NX, TX1 and TX2 as well as the Jetson Nano.

The bulletin highlights a vulnerability codified as CVE-2021-34372 to be the most severe one. It allowed bad actors to execute a buffer overflow attack on the device running the Jetson SoC. Even though the hacker would need network access to the victim system to execute the attack, the hack itself is not very difficult to pull off.

Additionally, a system compromised using this buffer overflow technique would be further exposed to a number of escalated threats, including denial of service, information disclosure and the bad actor gaining elevated privileges on the device.

Of the remaining severe vulnerabilities addressed, another six would also allow the bad actor carrying out the attack to execute a denial of service attack. A number of other vulnerabilities and bugs had to do with how the memory and request buffers on the devices were handled and could primarily lead to partial of complete denial of service.

The remainder of the high-threat level vulnerabilities are tracked as CVE-2021-34373 through CVE-2021-34380.

The good news is that the software update is released and owners of any systems and devices running Jetson SoC hardware should update them as soon as possible.