644
VMScore

CVE-2018-6242

Published: 01/05/2018 Updated: 13/06/2018
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 6.8 | Impact Score: 5.9 | Exploitability Score: 0.9
VMScore: 644
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

Some NVIDIA Tegra mobile processors released before 2016 contain a buffer overflow vulnerability in BootROM Recovery Mode (RCM). An attacker with physical access to the device's USB and the ability to force the device to reboot into RCM could exploit the vulnerability to execute unverified code.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

nvidia tegra_bootrom_rcm -

Vendor Advisories

On April 24, 2018, researchers disclosed a vulnerability that takes advantage of a buffer overflow vulnerability in NVIDIA TX1 BootROM when Recovery Mode (RCM) is active This vulnerability could allow an unprivileged, local attacker to bypass secure boot and execute unverified code on an affected system The vulnerability has been identified by CV ...

Github Repositories

NXBoot is a Tegra (Nintendo Switch) payload injector for iOS and macOS devices.

NXBoot This application enables provisioning a Tegra X1 powered device with early boot code using an iOS or macOS device For example, you may use this application to start the Hekate Bootloader or the Lakka Linux Distrobution (RetroArch) on a supported Nintendo Switch Disclaimer: Early boot code has full access to the device it runs on and can damage it No boot code is shipp

Rust implementation of the Fusée Gelée exploit (CVE-2018-6242) for Tegra processors.

fusee-gelee Rust implementation of the Fusée Gelée exploit (CVE-2018-6242) for Tegra processors Currently supported platforms: Linux via libusb Instructions Obtain executable version of the exploit launcher Obtain a payload suitable for use on the target device Execute the launcher, providing a path to the payload: /fusee-gelee /path/to/fusee-primarybin

Here's an overview of my more useful repos: Exploits WAMpage (CVE-2022-23731) - webOS root LPE, including a V8 exploit RootMyTV (CVE-2022-23727) - A user-friendly root exploit for LG webOS Smart TVs NXLoader - Exploit CVE-2018-6242 from (almost) any Android device fusee-nano - Exploit CVE-2018-6242 from embedded linux devices PageSigner Signature Forgery - Si

Fusée Gelée * -- / / ` + | | ' \ \__, * + '--' * + /\ + ' '

A curated list of awesome things related to Nintendo Switch hacking

Awesome Switch A curated list of awesome things related to Nintendo Switch hacking Resources Writeups Hardmod Exploits Bootrom Webkit Exploit payloads Fusée Gelée shofEL2 CFW Tools Other OS Linux Misc Resources Writeups CVE-2018-6242 MITRE Entry ShofEL2, a Tegra X1 and Nintendo Switch exploit Vulnerability Disclosure: Fusée Gelée FA

Collection of "modchip" designs for launching payloads via the Tegra RCM bug (CVE-2018-6242)

RCM Bug "Modchip" Archive This work-in-progress repository collects a variety of sample embedded devices which trigger the "Fusée Gelée"/"ShofEL2" vulnerability (CVE-2018-6242) Nothing in this respository is ready for public use

Wrapper Readme: A basic wrapper/git submodule/python module for ktempkin's fusee-launcher to allow easy use of it in other programs LyfeOnEdge -GPL3 Original Repository: githubcom/Qyriad/fusee-launcher Original Readme: Fusée Gelée * -- / / `

Implementation of CVE-2018-6242 (AKA Fusée Gelée, AKA shofel2)

This repository contains the source code for the fusee-toy project, my basic implementation of CVE-2018-6242 (AKA Fusée Gelée, AKA shofel2) It was written in January 2021 to better my knowledge of the vulnerability This implementation has been built using the fusee-nano and fusee-launcher projects as reference It is built to work on modern Linux environments

Fusée Gelée * -- / / ` + | | ' \ \__, * + '--' * + /\ + ' '

Fusée Gelée * -- / / ` + | | ' \ \__, * + '--' * + /\ + ' '