CVE-2023-25518

NVIDIA Jetson contains a vulnerability in CBoot, where the PCIe controller is initialized without IOMMU, which may allow an attacker with physical access to the target device to read and write to arbitrary memory. A successful exploit of this vulnerability may lead to code execution, denial of service, information disclosure, and loss of integrity.
References
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*
OR cpe:2.3:h:nvidia:jetson_agx_xavier:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:*:*:*:*:*:*

History

04 Jul 2023, 01:52

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.8
References (MISC) https://https://nvidia.custhelp.com/app/answers/detail/a_id/5466 - (MISC) https://https://nvidia.custhelp.com/app/answers/detail/a_id/5466 - Vendor Advisory
CPE cpe:2.3:o:nvidia:jetson_linux:*:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_xavier_nx:-:*:*:*:*:*:*:*
cpe:2.3:h:nvidia:jetson_agx_xavier:-:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
First Time Nvidia
Nvidia jetson Linux
Nvidia jetson Agx Xavier
Nvidia jetson Xavier Nx

23 Jun 2023, 19:24

Type Values Removed Values Added
New CVE

Information

Published : 2023-06-23 18:15

Updated : 2024-02-28 20:13


NVD link : CVE-2023-25518

Mitre link : CVE-2023-25518

CVE.ORG link : CVE-2023-25518


JSON object : View

Products Affected

nvidia

  • jetson_linux
  • jetson_xavier_nx
  • jetson_agx_xavier
CWE
NVD-CWE-noinfo CWE-923

Improper Restriction of Communication Channel to Intended Endpoints