NVIDIA Jetson Linux (initrd, nvluks trusted application): The nvluks trusted application is left enabled after initrd

Impact

The nvluks trusted application is left enabled after initrd has finished with it, so the component that unwraps disk-encryption keys stays reachable once the system is up. An attacker with the device in hand and a low-privileged account can ask it to do its job and recover the contents of the encrypted rootfs. In practical terms full-disk encryption stops protecting a Jetson device that leaves your custody, which is the one scenario it was deployed for.

Who can reach it

Physical possession of the device plus a low-privileged local foothold. Not reachable over the network, so this is a lost, stolen, seized or RMA'd hardware problem rather than a remote fleet problem - which makes it a real concern for anything deployed outside a controlled facility.

What to do

Update Jetson Linux to 35.6.4, 36.5 or 38.4 depending on branch, and reboot for the new initrd to take effect. Any device that has been outside your physical control while running an affected version should be treated as key-compromised: re-key the LUKS volumes and rotate every secret the device held.

References