Integer overflow in NVIDIA Jetson Agx Xavier
CVE-2022-28195
NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function, where insufficient validation of untrusted data may allow a highly privileged local attacker to cause a integer overflow, which may lead to code execution, escalation of privileges, limited denial of service, and some impact to confidentiality and integrity. The scope of impact can extend to other components.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.002 (14.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L.
Affected products
- Nvidia Jetson_agx_xavier
- Nvidia Jetson Agx Xavier Series, Nx — versions All 32.x versions prior to 32.7.2
- Nvidia Jetson_linux
- Nvidia Jetson_xavier_nx
Weakness classification (CWE)
References
- psirt@nvidia.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-28195?
- CVE-2022-28195 is a medium-severity vulnerability in NVIDIA Jetson Agx Xavier, classified under Improper Input Validation. CVSS score: 5.7/10. Published 2022-04-27.
- How severe is CVE-2022-28195?
- Medium severity. CVSS v3 base score is 5.7 out of 10.