Jetson AGX Xavier / Orin bootloader: Local privesc (stack overflow in bootloader)

CVSS 7.8CVE-2022-42270NVIDIA / GPU stackcurated

Impact

Local privesc (stack overflow in bootloader)

Who can reach it

Local operator / physical

What to do

Flash bootloader firmware out-of-band

References

https://nvd.nist.gov/vuln/detail/CVE-2022-42270 https://github.com/NVIDIA/product-security/tree/main/2023/5442

Related entries

DGX-2 BMC: RCE on BMC (buffer overflow)CVE-2022-42274 · DGX-2 BMCHigh
Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2022-48979 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu): A use-after-free in the amdgpu RAS / GPU reset andCVE-2022-48990 · Linux kernel amdgpu RAS / GPU reset and recovery path (drm/amdgpu)High
Linux kernel amdgpu display core (DC/DM) (drm/amd/display): A double free in the amdgpu display core (DC/DM)CVE-2022-49203 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
Linux kernel amdgpu power management (SMU/powerplay) (drm/amd/pm): A use-after-free in the amdgpu power managementCVE-2022-49530 · Linux kernel amdgpu power management (SMU/powerplay) (drm/amd/pm)High
Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2022-49969 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.